26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 66:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 7d7789f9e302… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7d7789f9e302…. Malware family: Trojan.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 5 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece"],"about":{"@type":"SoftwareApplication","name":"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1018,Found reference to API "WriteProcessMemory64From32" (Indicator: "WriteProcessMemory"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "NtWow64WriteVirtualMemory64"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "[-] VirtualAlloc failed" (Indicator: "VirtualAlloc"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "[-] CreateThread failed" (Indicator: "CreateThread"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "-] VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "-] CreateThread failed" (Indicator: "CreateThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "tCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "WriteProcessMemory64From32" (Indicator: "WriteProcessMemory"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "WriteVirtualMemory"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "NtWow64WriteVirtualMemory64" (Indicator: "NtWow64WriteVirtualMemory64"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp")28:Taa9,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "SystemQueryPerformanceCounterInformation" (Indicator: "QueryPerformanceCounter"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "tWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "SystemQueryPerformanceCounterInformation" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp")29:T706,Found reference to API "LoadLibrary64" (Indicator: "LoadLibrary"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "FreeLibrary64" (Indicator: "FreeLibrary"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "LoadLibrary64" (Indicator: "LoadLibrary"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "FreeLibrary64" (Indicator: "FreeLibrary"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp")2a:T1455,Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "TripleDES" (Indicator: "TripleDES"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "AesManaged" (Indicator: "Aes"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "AesManaged" (Indicator: "AesManaged"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "AesGcm" (Indicator: "Aes"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "AesGcm" (Indicator: "AesGcm"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "AesManaged" (Indicator: "Aes"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "AesManaged" (Indicator: "AesManaged"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "AesGcm" (Indicator: "Aes"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "AesGcm" (Indicator: "AesGcm"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp")2b:T74a,Found reference to API "_BCryptImportKey_KeyDataBlob" (Indicator: "BCryptImportKey"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "_BCryptImportKey_KeyDataBlob" (Indicator: "BCryptImportKey"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp")2c:T4c3,Found reference to API "_BCryptImportKey_KeyDataBlob" (Indicator: "CryptImportKey"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "BCryptImportKey" (Indicator: "CryptImportKey"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "BCryptGetProperty" (Indicator: "BCryptGetProperty"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe")2d:T932,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains ability to perform AES encryption (Dotnet String) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to access crypto wallet extension (string) Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt data Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to perform AES cryptographic operations (Dotnet) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - RC4 Encryption Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: YARA signature match – Encryption algorithm Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Contains cryptographic functions of the CryptoAPI2e:T4d6,Found XOR loop in file "sample.bin" at offset 140269; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 156691; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 374270; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 400246; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 546498; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 133357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 237376; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 297339; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 321151; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 440277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 494616; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 86197; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 113258; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 421400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 466293; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 486547; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 571217; code bytes = 80302f:Tf69,Found reference to API "d__1" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "d__2" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "d__3" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "d__5" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "d__7" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "SendMessageAsync" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "SendMessageInfoAsync" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "+Stub.DiscordSendLogs+d__2" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "/Stub.DiscordSendLogs+d__3" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "'Stub.FtpSendLogs+d__5" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "+Stub.FtpSendLogs+d__7" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API ",Stub.TelegramSendLogs+d__2" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "0Stub.TelegramSendLogs+d__3" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "'Stub.UploadToFtp+d__1" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "Discord >> SendMessage exception:" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "/sendMessage?chat_id=" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "Telegram >> SendMessage exception:" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "Discord >> SendMessage exception:\n" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "Telegram >> SendMessage exception:\n" (Indicator: "sendmessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00003516-00000C2B-74944905") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00003516-00000C2B-74944969") Found reference to API "iscord >> SendMessage exception:" (Indicator: "sendmessage"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "sendMessage?chat_id=" (Indicator: "sendmessage"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "elegram >> SendMessage exception:" (Indicator: "sendmessage"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "d__1" (Indicator: "sendmessage"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp")30:Tabe,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e00e9020000107e330000000000080000000000000090f14e00000000000000000000000000254884f0fe0700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000004cfffe07000090f14e00000000000000000000000000b8f14e00000000000000000000000000f8926de5b5c90000000000000000000008823ffffe0700000000000000000000e005010000000000000000000000000000000000000000000000000000000000b4be46fffe070000405947ff (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000c8039977000000000000000000000000a0000000000000000000330000000000000000000000000094000000000000001803330000000000d8dd8c7700000000000033000000000002000000000000009400000000000000a0000000000000001803330000000000e0f02700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001b8186f0fe07000018000000 (UID: 00000000-00003516)31:T1e5e,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000100000000000000bbba46fffe070000f0b03a000000000010143ffffe07000001000000000000001aab88fdfe070000010000000000000059bc46fffe0700000000000000000000000000000000000000000000000000009ad140fffe07000008000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000038003800360062006600370063003300370066003300640062006300370062006500300061006400630033003600310061003400350031006600660061006400330033003300650030003800370065006500370032006400390032006500630065002e00650078006500000000000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000002014e20200000000000000000000000003000000000000008000000000000000d0d1b21c00000000c4676af0fe070000020000000000000010000000000000000000000000000000c000b2e4fe0700001000000000000000a169a4f4fe07000000000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031001c00000000b8d3b21c00000000ffffffff0000000014d3b21c00000000000000000000000000000000000000001000000000000000c4676af0fe07000002000000000000001000000000000000ffffffff00000000d92763e9fe0700001000000000000000a169a4f4fe07000058693001 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100ff000000000300000000000000c882ed02000000002014e20200000000000000000000000040d4b21c000000000300000000000000c4676af0fe07000002000000000000001000000000000000c882ed0200000000b077a4f4fe0700001000000000000000a169a4f4fe07000000000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000002014e20200000000000000000000000003000000000000008000000000000000d0d1b21c00000000c4676af0fe070000020000000000000010000000000000000000000000000000207a3300000000001000000000000000a169a4f4fe07000000000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100ff00000000030000000000000088a9ed02000000002014e20200000000000000000000000040d4b21c000000000300000000000000c4676af0fe0700000200000000000000100000000000000088a9ed0200000000b077a4f4fe0700001000000000000000a169a4f4fe07000000000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000002014e2020000000000000000000000000300000000000000800000000000000060e1b21c00000000c4676af0fe07000002000000000000001000000000000000000000000000000010080000000000001000000000000000a169a4f4fe07000000000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031001c0000000048e3b21c00000000ffffffff00000000a4e2b21c00000000000000000000000000000000000000001000000000000000c4676af0fe07000002000000000000001000000000000000ffffffff00000000d92763e9fe0700001000000000000000a169a4f4fe07000058693001 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100ff0000000003000000000000000031e303000000002014e202000000000000000000000000d0e3b21c000000000300000000000000c4676af0fe070000020000000000000010000000000000000031e30300000000b077a4f4fe0700001000000000000000a169a4f4fe07000000000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100ff0000000003000000000000008056e303000000002014e202000000000000000000000000d0e3b21c000000000300000000000000c4676af0fe070000020000000000000010000000000000008056e30300000000b077a4f4fe0700001000000000000000a169a4f4fe07000000000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000002014e2020000000000000000000000000300000000000000800000000000000020db301b00000000c4676af0fe07000002000000000000001000000000000000000000000000000010080000000000001000000000000000a169a4f4fe07000000000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031001b0000000008dd301b00000000ffffffff0000000064dc301b00000000000000000000000000000000000000001000000000000000c4676af0fe07000002000000000000001000000000000000ffffffff00000000d92763e9fe0700001000000000000000a169a4f4fe070000786d3001 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100ff000000000300000000000000b802f803000000002014e20200000000000000000000000090dd301b000000000300000000000000c4676af0fe07000002000000000000001000000000000000b802f80300000000b077a4f4fe0700001000000000000000a169a4f4fe07000000000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100ff0000000003000000000000003828f803000000002014e20200000000000000000000000090dd301b000000000300000000000000c4676af0fe070000020000000000000010000000000000003828f80300000000b077a4f4fe0700001000000000000000a169a4f4fe07000000000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000002014e2020000000000000000000000000300000000000000800000000000000090de301b00000000c4676af0fe07000002000000000000001000000000000000000000000000000010080000000000001000000000000000a169a4f4fe07000000000000 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031001b0000000078e0301b00000000ffffffff00000000d4df301b00000000000000000000000000000000000000001000000000000000c4676af0fe07000002000000000000001000000000000000ffffffff00000000d92763e9fe0700001000000000000000a169a4f4fe070000786d3001 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100ff000000000300000000000000b86ff803000000002014e20200000000000000000000000000e1301b000000000300000000000000c4676af0fe07000002000000000000001000000000000000b86ff80300000000b077a4f4fe0700001000000000000000a169a4f4fe07000000000000 (UID: 00000000-00003516)32:T5c6,Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SELECT * FROM win32_operatingsystem" (Indicator: "select * from "; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "Select * from AntivirusProduct" (Indicator: "select * from "; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "Select * From Win32_ComputerSystem" (Indicator: "select * from "; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; Source: "00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.1D170000.00000004.mdmp") Found string "Select * from AntivirusProduct" (Indicator: "select * from "; Source: "00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp")33:T590,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "58359857024,4572,3024,,RtlGetVersion,NTDLL.dll,"943:34:25.857",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp, 00000000-00003516.00000003.76746.1D170000.00000004.mdmp")34:Tfe1,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPNAMESERVER"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "QUERYADAPTERNAME"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "")35:T776,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")36:T381b,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\nlssorting.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Net.Http\04ab5d047cc99fc5dad36592f805b227\System.Net.Http.ni.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\gdiplus.dll (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00003516)37:T130da,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetEnvironmentStrings (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FreeEnvironmentStrings (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetFileAttributes (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetCurrentDirectory (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetPerAdapterInfo (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter gethostname (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter TraceRegisterExA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter TracePrintfExA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter OpenSCManagerA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter Ndr64AsyncClientCall (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter IsClipboardFormatAvailable (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter OpenClipboard (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetClipboardData (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CloseClipboard (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateDC (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetWindowLongPtr (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetWindowLongPtr (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter TranslateMessageW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter DispatchMessage (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GdipGetImageGraphicsContext (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GdipSaveImageToFile (UID: 00000000-00003516) "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00003516)38:T860,"costura.costura.dll.compressed|5.7.0.0|Costura, Version=5.7.0.0, Culture=neutral, PublicKeyToken=null|Costura.dll|F1F25C01F6ACF33BDD62C4F82D3EF078E76F0906|4608costura.costura.pdb.compressed|||Costura.pdb|6C6000A5EAF8579850AB82A89BD6268776EB51AD|2608costura.newtonsoft.json.dll.compressed|13.0.0.0|Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed|Newtonsoft.Json.dll|1E76E6099570EDE620B76ED47CF8D03A936D49F8|711952costura.icsharpcode.sharpziplib.dll.compressed|1.3.3.11|ICSharpCode.SharpZipLib, Version=1.3.3.11, Culture=neutral, PublicKeyToken=1b03e6acf1164f73|ICSharpCode.SharpZipLib.dll|EDF2AB9EE284FA21DBB55E93D082848E800F068B|204800costura.icsharpcode.sharpziplib.pdb.compressed|||ICSharpCode.SharpZipLib.pdb|797D83BFE6A654FE21916806E6CA7BCBB3B4C3FB|102612costura.system.diagnostics.diagnosticsource.dll.compressed|4.0.1.0|System.Diagnostics.DiagnosticSource, Version=4.0.1.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51|System.Diagnostics.DiagnosticSource.dll|85DC92EDD" "costura.costura.pdb.compressed" "costura.icsharpcode.sharpziplib.pdb.compressed" "costura.costura.dll.compressed|5.7.0.0|Costura, Version=5.7.0.0, Culture=neutral, PublicKeyToken=null|Costura.dll|F1F25C01F6ACF33BDD62C4F82D3EF078E76F0906|4608costura.costura.pdb.compressed|||Costura.pdb|6C6000A5EAF8579850AB82A89BD6268776EB51AD|2608costura.newtonsoft.json.dll.compressed|13.0.0.0|Newtonsoft.Json, Version=13.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed|Newtonsoft.Json.dll|1E76E6099570EDE620B76ED47CF8D03A936D49F8|711952costura.icsharpcode.sharpziplib.dll.compressed|1.3.3.11|ICSharpCode.SharpZipLib, Version=1.3.3.11, Culture=neutral, PublicKeyToken=1b03e6acf1164f73|ICSharpCode.SharpZipLib.dll|EDF2AB9EE284FA21DBB55E93D082848E800F068B|204800costura.icsharpcode.sharpziplib.pdb.compressed|||ICSharpCode.SharpZipLib.pdb|797D83BFE6A654FE21916806E6CA7BCBB3B4C3FB|102612costura.system.diagnostics.diagnosticsource.dll.compressed|4.0.1.0|System.Diagnostics.DiagnosticSource, Version=4.0.1.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51|System.Diagnostics.DiagnosticSource.dll|85DC92ED" "rpziplib.pdb.compressed"39:T53a,"SELECT * FROM Win32_VideoController" (Source: 600001d-AntiAnalysis~SuspiciousGPU, Indicator: "select * from win32_videocontroller") "SELECT * FROM win32_operatingsystem" (Source: 6000268-SystemInfo~GetWindowsVersionName, Indicator: "select * from win32_operatingsystem") "Select * from AntivirusProduct" (Source: 600026c-SystemInfo~GetAntivirus, Indicator: "select * from antivirusproduct") "SELECT * FROM Win32_Processor" (Source: 600026f-SystemInfo~GetCpuName, Indicator: "select * from win32_processor") "Select * From Win32_ComputerSystem" (Source: 6000271-SystemInfo~GetRamAmount, Indicator: "select * from win32_computersystem") "SELECT * FROM Win32_VideoController" (Source: 00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.1D170000.00000004.mdmp, Indicator: "select * from win32_videocontroller") "Select * from AntivirusProduct" (Source: 00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp, Indicator: "select * from antivirusproduct")3a:Tb5be,Found reference to API (Indicator: "CreateFileMappingA"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "OpenServiceW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "QueryFullProcessImageNameW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "ChangeServiceConfigW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CreateProcessWithTokenW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CreateDesktopW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "OpenDesktopW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "OpenSCManagerW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CreateProcessW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetClipboardData"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SetClipboardData"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetThreadId"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "NtSuspendThread"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "NtResumeThread"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CreateThread"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CreateRemoteThread"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetProcessIdOfThread"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CloseClipboard"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "OpenClipboard"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CredFree"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GlobalFree"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "VirtualFree"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetModuleHandle"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CloseHandle"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "LdrGetDllHandle"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "AllocConsole"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetFileType"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CoUninitialize"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "RevertToSelf"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetTempPath"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GlobalLock"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "IsProcessCritical"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "LdrLoadDll"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "LdrUnloadDll"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "Sleep"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CloseDesktop"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SetLastError"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "IsWow64Process"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "TerminateProcess"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "OpenProcess"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetProcAddress"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "LdrGetProcedureAddress"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetWindowRect"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "NtWaitForSingleObject"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "VirtualProtect"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "BCryptDecrypt"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "NtCreateThreadEx"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "VirtualFreeEx"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SetWindowsHookEx"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "DuplicateTokenEx"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "BCryptImportKey"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "BCryptDestroyKey"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "FreeLibrary"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CreateDirectory"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SetCurrentDirectory"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetSidSubAuthority"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "BCryptGetProperty"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "BCryptSetProperty"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "Local State"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetSecurityDescriptorControl"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CopySid"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "IsValidSid"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "InitializeSid"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "InitializeAcl"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetLengthSid"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetSidLengthRequired"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "MakeAbsoluteSD"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetAclInformation"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "IsValidSecurityDescriptor"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "AddAce"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SearchPathW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetVersionExW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetLastError"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "FindResourceExW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "HeapDestroy"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "LoadResource"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "FormatMessageW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetTickCount"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CreateEventW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SetThreadUILanguage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetVersionExA"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "ExitProcess"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "lstrlenW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "OpenEventW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "HeapSize"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "LocalFree"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "HeapAlloc"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CreateFileW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "HeapFree"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SetEvent"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "RaiseException"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SysAllocString"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SysStringLen"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "SysFreeString"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "LoadStringW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "UnregisterClassA"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "TranslateMessage"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "RtlAllocateHeap"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "RtlFreeHeap"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "ProgIDFromCLSID"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CoInitializeSecurity"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "InitializeSid"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetSidLengthRequired"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "ProgIDFromCLSID"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "RtlFreeHeap"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "RtlAllocateHeap"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessWithTokenW"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CreateDesktopW"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "OpenDesktopW"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetThreadId"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "NtSuspendThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "NtResumeThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CreateRemoteThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetProcessIdOfThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CredFree"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "LdrGetDllHandle"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "AllocConsole"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "IsProcessCritical"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "LdrLoadDll"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "LdrUnloadDll"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "NtWaitForSingleObject"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "BCryptDecrypt"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "NtCreateThreadEx"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "VirtualFreeEx"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "BCryptImportKey"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "BCryptDestroyKey"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "SetCurrentDirectory"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "BCryptSetProperty"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp")3b:T6a9,Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "[-] CreateThread failed" (Indicator: "CreateThread"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "-] CreateThread failed" (Indicator: "CreateThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "tCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "NtSuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "NtResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp")3c:T422,Observed Namespace "System.IO.File" and MemberReference "GetAttributes" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.IO.File" and MemberReference "SetAttributes" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.IO.FileSystemInfo" and MemberReference "get_Attributes" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.IO.FileSystemInfo" and MemberReference "set_Attributes" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.IO.File" and MemberReference "SetCreationTime" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.IO.File" and MemberReference "SetLastWriteTime" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.IO.File" and MemberReference "SetLastAccessTime" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe"3d:T1a27,"Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe "SOFTWARE\Clients\StartMenuInternet" in Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe "SOFTWARE\WOW6432Node\Clients\StartMenuInternet" in Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe "Software\Martin Prikryl\WinSCP 2\Configuration\Security" in Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe "SOFTWARE\\Microsoft\\Cryptography" in Source: 6000021-AntiAnalysis~SuspiciousMachineGuid "SOFTWARE\\Classes\\Foxmail.url.mailto\\Shell\\open\\command" in Source: 6000110-FoxMail~GetFoxMailLocation "Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" in Source: 60001dc-Outlook~GrabOutlook "Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" in Source: 60001dc-Outlook~GrabOutlook "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" in Source: 60001dc-Outlook~GrabOutlook "Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676" in Source: 60001dc-Outlook~GrabOutlook "\\BraveSoftware\\Brave-Browser\\User Data" in Source: 60001e9-cctor "\\Opera Software\\Opera Stable" in Source: 60001e9-cctor "\\Opera Software\\Opera Neon\\User Data" in Source: 60001e9-cctor "\\Opera Software\\Opera Crypto Developer" in Source: 60001e9-cctor "\\Opera Software\\Opera GX Stable" in Source: 60001e9-cctor "\\AVAST Software\\Browser\\User Data" in Source: 60001e9-cctor "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 6000256-Startup~IsInstalled "SOFTWARE\\Clients\\StartMenuInternet" in Source: 60002d4-Utils~GetInstalledBrowsers "SOFTWARE\\WOW6432Node\\Clients\\StartMenuInternet" in Source: 60002d4-Utils~GetInstalledBrowsers "Software\\Martin Prikryl\\WinSCP 2\\Configuration\\Security" in Source: 60002f9-WinScp~GetInfo "Software\\Martin Prikryl\\WinSCP 2\\Sessions" in Source: 60002f9-WinScp~GetInfo "\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "era Software\Opera Stable" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "\Opera Software\Opera Crypto Developer" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "Software\Browser\User Data" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002996.00000000.75872.FFA21000.00000020.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "Opera Software\Opera Stable" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "Opera Software\Opera Crypto Developer" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp 00000000-00003516.00000002.71218.1D170000.00000004.mdmp 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp 00000000-00003516.00000002.71218.1D170000.00000004.mdmp 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp 00000000-00003516.00000002.71218.1D170000.00000004.mdmp 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "2Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp 00000000-00003516.00000002.71218.1D170000.00000004.mdmp 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE1" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp 00000000-00003516.00000002.71218.1D170000.00000004.mdmp 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp 00000000-00003516.00000002.71218.1D170000.00000004.mdmp 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp 00000000-00003516.00000002.71218.1D170000.00000004.mdmp 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp 00000000-00003516.00000002.71218.1D170000.00000004.mdmp 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp 00000000-00003516.00000002.71218.1D170000.00000004.mdmp 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp 00000000-00003516.00000002.71218.1D170000.00000004.mdmp 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp 00000000-00003516.00000002.71218.1D170000.00000004.mdmp 00000000-00003516.00000003.76746.1D170000.00000004.mdmp3e:Td16,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135]3f:T980,Observed unmanaged function "GetModuleHandle" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "BCryptOpenAlgorithmProvider" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "BCryptCloseAlgorithmProvider" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "BCryptGetProperty" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "BCryptSetProperty" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "BCryptImportKey" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "BCryptDestroyKey" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "BCryptDecrypt" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "OpenClipboard" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "CloseClipboard" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "GetClipboardData" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "IsClipboardFormatAvailable" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "GlobalLock" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "GlobalUnlock" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "EmptyClipboard" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "SetClipboardData" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "GlobalAlloc" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "GlobalFree" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "VirtualAlloc" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed unmanaged function "CreateThread" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe"40:T1627,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00002996.00000000.75872.FFA21000.00000020.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "Opera Software\Opera Stable" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "Opera Software\Opera Crypto Developer" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp "2Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE1" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00003516.00000001.69295.1D170000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE" in Source: 00000000-00003516.00000002.71218.1D170000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00003516.00000002.71218.1D170000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00003516.00000002.71218.1D170000.00000004.mdmp "2Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00003516.00000002.71218.1D170000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE1" in Source: 00000000-00003516.00000002.71218.1D170000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00003516.00000002.71218.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00003516.00000002.71218.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00003516.00000002.71218.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00003516.00000002.71218.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00003516.00000002.71218.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00003516.00000002.71218.1D170000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE" in Source: 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services\Class\" in Source: 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "2Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000" in Source: 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE1" in Source: 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00003516.00000003.76746.1D170000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00003516.00000003.76746.1D170000.00000004.mdmp41:T36bf,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "GDI32.DLL" at base 7feff4c0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7fefefa0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fef93c0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "KERNEL32" at base 77760000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "ADVAPI32.DLL" at base 7feff310000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fef08a0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "SHLWAPI.DLL" at base 7feff160000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "VERSION.DLL" at base 7fefc650000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fee94c0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "USER32.DLL" at base ff0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "MSCOREE.DLL" at base 7fef0950000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "NTDLL" at base 77880000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "PSAPI.DLL" at base 77a40000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "RPCRT4.DLL" at base 7fefedf0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "KERNEL32.DLL" at base 77760000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fee7ec0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "OLE32.DLL" at base 7fefebd0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "CRYPTBASE.DLL" at base 7fefd3d0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fef2c80000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7feee760000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fee7250000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7fee7050000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7fee5fa0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fee5520000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7feee620000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7fee4c70000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NLSSORTING.DLL" at base 7fef4a70000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "NTDLL.DLL" at base 77880000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "SHELL32.DLL" at base 1bc40000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7fefedd0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "PROFAPI.DLL" at base 7fefd570000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "BCRYPT.DLL" at base 7fefceb0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "CRYPTSP.DLL" at base 7fefcd60000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fefca60000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "SSPICLI.DLL" at base 7fefd340000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7fee4b00000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 7fefedd0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "RPCRTREMOTE.DLL" at base 7fefd4c0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7fef4a40000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "CLBCATQ.DLL" at base 7feff640000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77760000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7fef4cd0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7fef5ac0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7fef4d00000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7fef5e90000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "OLEAUT32.DLL" at base 7fefeaf0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "ADVAPI32" at base 7feff310000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NET.HTTP\04AB5D047CC99FC5DAD36592F805B227\SYSTEM.NET.HTTP.NI.DLL" at base 7feea140000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "IPHLPAPI.DLL" at base 7fefb1d0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "DNSAPI.DLL" at base 7fefcb80000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "DHCPCSVC6.DLL" at base 7fefaee0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "DHCPCSVC.DLL" at base 7fefae60000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "WS2_32.DLL" at base 7fefeaa0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7fefcd00000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 7fefc720000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 7fefccf0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7fefb3a0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7fefac70000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7fefa920000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7fefa910000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "RASADHLP.DLL" at base 7fef9f40000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7fefaf10000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "RASAPI32.DLL" at base 7fef1ec0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "RTUTILS.DLL" at base 7fefaa00000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 7fefedd0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 7fefedd0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "RASMAN.DLL" at base 7fef2c90000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "WINHTTP.DLL" at base 7fefa1b0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "CREDSSP.DLL" at base 7fefc960000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "NSI.DLL" at base 7fefea90000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "CFGMGR32.DLL" at base 7fefd820000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7fee4990000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 7fefedd0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fefbb20000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "IMM32.DLL" at base 7fefefa0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "COMCTL32.DLL" at base 7fefa5b0000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "GDIPLUS.DLL" at base 7fefb880000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_145EB2808B8D6928\GDIPLUS.DLL" at base 7fefb880000 "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" loaded module "WINDOWSCODECS.DLL" at base 7fefb04000042:T495,"10001100fe0700002818d6fcfe070000@rsaenh.dll" "10001100fe0700001018d6fcfe070000@rsaenh.dll" "08000900fe0700000018d6fcfe070000@rsaenh.dll" "0b000c00fe070000f017d6fcfe070000@rsaenh.dll" "0c000d00fe070000e017d6fcfe070000@rsaenh.dll" "0d000e00fe070000d017d6fcfe070000@rsaenh.dll" "0d000e00fe070000c017d6fcfe070000@rsaenh.dll" "0b000c00fe070000b017d6fcfe070000@rsaenh.dll" "0b000c00fe070000a017d6fcfe070000@rsaenh.dll" "09000a00fe0700009017d6fcfe070000@rsaenh.dll" "09000a00fe0700008017d6fcfe070000@rsaenh.dll" "0c000d00fe0700007017d6fcfe070000@rsaenh.dll" "0a000b00fe0700006017d6fcfe070000@rsaenh.dll" "10001100fe0700004817d6fcfe070000@rsaenh.dll" "0d000e00fe0700003817d6fcfe070000@rsaenh.dll" "0a000b00fe0700002817d6fcfe070000@rsaenh.dll" "11001200fe0700001017d6fcfe070000@rsaenh.dll" "0b000c00fe0700000017d6fcfe070000@rsaenh.dll" "0c000d00fe070000f016d6fcfe070000@rsaenh.dll" "0e000f00fe070000e016d6fcfe070000@rsaenh.dll" "0e000f00fe070000d016d6fcfe070000@rsaenh.dll" "0e000f00fe070000c016d6fcfe070000@rsaenh.dll" "0e000f00fe070000b016d6fcfe070000@rsaenh.dll" "0e000f00fe070000a016d6fcfe070000@rsaenh.dll" "0f001000fe0700009016d6fcfe070000@rsaenh.dll"43:T516,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")44:T6c7,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "DISMHOST.EXE.691305D5.bin" file has an entrypoint instructions - "sub rsp, 0x28,call 0x10000fcc0,add rsp, 0x28,jmp 0x10000f0b8,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],cmp rcx, qword ptr [rip + 0x6da9],jne 0x10000f40b,rol rcx, 0x10,test cx, 0xffff,jne 0x10000f407,ret 0,ror rcx, 0x10,jmp 0x10000fd7c,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov dword ptr [rsp + 0x18], r8d,mov qword ptr [rsp + 8], rcx,push rsi,push rdi,push r12,sub rsp, 0x40,"45:Te48,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HANS") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HANS") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS-CZ") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS-CZ") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DA")46:T1014,Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00003516-00000C65-52402352] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00003516-00000C2A-53347578] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00003516-00000C2A-53691314] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00003516-00000C2A-55768254] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003516-00000C2A-56003895] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00003516-00000C2A-56379846] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00003516-00000C2A-56434599] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00003516-00000C2A-56587313] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00003516-00000C2A-56655094] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll" [Source: 00000000-00003516-00000C2A-56801278] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll" [Source: 00000000-00003516-00000C2A-56944104] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00003516-00000C2A-57065037] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll" [Source: 00000000-00003516-00000C2A-57111312] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00003516-00000C2A-57637433] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\nlssorting.dll" [Source: 00000000-00003516-00000C2A-57709939] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003516-00000C2A-58139319] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003516-00000C2A-58462921] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003516-00000C2A-58698250] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00003516-00000C2A-58810124] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00003516-00000C2A-59492202] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00003516-00000C2A-59662367] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00003516-00000C2A-59983126] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00003516-00000C2A-61452122] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Net.Http\04ab5d047cc99fc5dad36592f805b227\System.Net.Http.ni.dll" [Source: 00000000-00003516-00000C2A-66419596] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00003516-00000C2A-68682128]47:T458,Found reference to API "LoadLibrary64" (Indicator: "LoadLibrary"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "LoadLibrary64" (Indicator: "LoadLibrary"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp")48:Ta30,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS\V4.0.30319"; Key: ""; Value: "")49:T1030,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DISABLEUSERMODECALLBACKFILTER"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL"; Key: "RELEASE"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "7D7789F9E30220D886BF7C37F3DBC7BE0ADC361A451FFAD333E087EE72D92ECE"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "DISABLECONFIGCACHE"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "763FD754-7086-4DFE-95EB-C01A46FAF4CA"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A669021C-C450-4609-A035-5AF59AF4DF18"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CC2BCBBA-16B6-4CF3-8990-D74C2E8AF500"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "CACHELOCATION"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "DOWNLOADCACHEQUOTAINKB"; Value: "")4a:T629,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\b138f79dea860272ebe6694d9b73f656\system.windows.forms.ni.dll.aux" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\ece80f2e3752a779e894fd45d8f27e64\system.drawing.ni.dll.aux" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\system.configuration.ni.dll.aux" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\5ee35debfc22f727e70e4479ddcbc045\system.xml.ni.dll.aux"4b:T801,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "C:\Windows\Temp\VxSSL64.dll" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "C:\FLTLIB.DLL" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "C:\Windows\Temp\VxOle64.dll" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to touch file "C:\7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe.config"4c:T7a2,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\FLTLIB.DLL" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\Windows\system32\combase.dll" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll"4d:T4a1,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe.config" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\stub\" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "C:\7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.INI" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}" "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{75AE3521-B756-4B3A-B364-4F4E2116BBF1}"4e:T9d3,Observed Namespace "System.Net.Mail.MailMessage" and MemberReference ".ctor" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "get_To" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.MailAddressCollection" and MemberReference "Add" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.MailAddress" and MemberReference ".ctor" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_From" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_Subject" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "set_Body" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.Attachment" and MemberReference ".ctor" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.MailMessage" and MemberReference "get_Attachments" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference ".ctor" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_UseDefaultCredentials" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_Credentials" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_Port" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_EnableSsl" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "set_DeliveryMethod" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" Observed Namespace "System.Net.Mail.SmtpClient" and MemberReference "SendMailAsync" in "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe"4f:Td01,Found string "5__1" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SmtpDeliveryMethod" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SmtpPassword" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "UploadToSmtp" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SmtpSender" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SmtpReceiver" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SmtpServer" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SmtpSendLogs" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SmtpClient" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SmtpPort" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SmtpCheckBox" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "(Stub.SmtpSendLogs+d__7" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "'Stub.SmtpSendLogs+d__8" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "(Stub.UploadToSmtp+d__8" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SMTP Email Address" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SMTP Server" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SMTP User Name" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SMTP User" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SMTP Password2" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SMTP Password" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "Config: Begin Decrypting Smtp details" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SmtpServer Decrypted: '" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SmtpSender Decrypted: '" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SmtpPassword Decrypted: '" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SmtpReceiver: '" (Indicator: "smtp"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe")50:T1cb5,"4.0.0.0" "11.0.0.0" "1.0.0.0" "10.200.169.204" "104.198.155.173" "104.200.151.35" "109.145.173.169" "109.226.37.172" "109.74.154.90" "109.74.154.91" "109.74.154.92" "140.228.21.36" "149.88.111.79" "154.61.71.50" "154.61.71.51" "172.105.89.202" "174.7.32.199" "176.63.4.179" "178.239.165.70" "181.214.153.11" "185.220.101.107" "185.44.176.125" "185.44.176.135" "185.44.176.143" "185.44.176.70" "185.44.176.85" "185.44.177.132" "185.44.177.133" "185.44.177.138" "185.44.177.193" "185.44.177.254" "185.44.177.55" "188.105.165.80" "188.105.71.44" "188.105.91.116" "188.105.91.143" "188.105.91.173" "191.101.209.39" "191.96.150.218" "192.211.110.74" "192.40.57.234" "192.87.28.103" "193.128.114.45" "193.225.193.201" "193.226.177.40" "194.110.13.70" "194.154.78.144" "194.154.78.152" "194.154.78.160" "194.154.78.169" "194.154.78.179" "194.154.78.210" "194.154.78.227" "194.154.78.230" "194.154.78.235" "194.154.78.77" "194.154.78.91" "194.186.142.178" "194.186.142.180" "194.186.142.183" "194.186.142.195" "194.186.142.204" "194.186.142.214" "194.186.142.236" "194.186.142.246" "195.181.175.103" "195.181.175.105" "195.228.105.39" "195.239.51.3" "195.239.51.42" "195.239.51.46" "195.239.51.59" "195.239.51.65" "195.239.51.73" "195.239.51.80" "195.239.51.89" "195.68.142.20" "195.68.142.3" "195.74.76.222" "2.94.86.134" "20.114.22.115" "20.99.160.173" "204.101.161.31" "204.101.161.32" "207.102.138.83" "207.102.138.93" "208.78.41.115" "209.127.189.74" "212.119.227.136" "212.119.227.151" "212.119.227.167" "212.119.227.179" "212.119.227.184" "212.41.6.23" "213.33.142.50" "213.33.190.109" "213.33.190.118" "213.33.190.171" "213.33.190.22" "213.33.190.227" "213.33.190.242" "213.33.190.35" "213.33.190.42" "213.33.190.46" "213.33.190.69" "213.33.190.74" "23.128.248.46" "34.105.0.27" "34.105.183.68" "34.105.72.241" "34.138.255.104" "34.138.96.23" "34.141.146.114" "34.141.245.25" "34.142.74.220" "34.145.195.58" "34.145.89.174" "34.17.49.70" "34.17.55.59" "34.253.248.228" "34.73.60.153" "34.83.46.130" "34.85.243.241" "34.85.253.170" "35.186.33.204" "35.192.93.107" "35.197.127.11" "35.199.6.13" "35.229.69.227" "35.237.47.12" "38.154.242.210" "45.8.148.171" "5.45.98.162" "52.250.30.131" "64.124.12.162" "67.218.111.202" "78.139.8.50" "79.104.209.109" "79.104.209.168" "79.104.209.172" "79.104.209.221" "79.104.209.231" "79.104.209.24" "79.104.209.249" "79.104.209.33" "79.104.209.36" "79.104.209.66" "80.211.0.97" "81.181.60.60" "84.147.54.113" "84.147.54.61" "84.147.56.249" "84.147.60.41" "84.147.60.52" "84.147.61.28" "84.147.62.12" "84.147.63.171" "84.147.63.236" "84.57.183.108" "84.57.200.69" "87.166.48.65" "87.166.50.1" "87.166.50.213" "87.166.51.209" "88.132.225.100" "88.132.226.203" "88.132.227.238" "88.132.231.71" "88.153.199.169" "88.64.35.141" "88.64.36.101" "88.66.107.75" "88.66.111.235" "88.66.8.175" "88.67.131.90" "88.67.134.91" "88.86.117.130" "89.208.29.106" "89.208.29.108" "89.208.29.140" "89.208.29.149" "89.208.29.63" "89.208.29.64" "89.208.29.95" "89.208.29.96" "89.208.29.97" "89.208.29.98" "92.211.109.160" "92.211.192.144" "92.211.52.62" "92.211.55.199" "93.216.75.209" "95.25.204.90" "95.25.71.112" "95.25.71.12" "95.25.71.5" "95.25.71.64" "95.25.71.65" "95.25.71.70" "95.25.71.80" "95.25.71.86" "95.25.71.87" "95.25.71.89" "95.25.71.92" "95.25.81.24" "8.105.91.116" "8.105.91.173" "1.96.150.218" "2.40.57.234" "3.128.114.45" "4.154.78.144" "4.154.78.160" "4.154.78.179" "4.154.78.227" "4.154.78.235" "4.186.142.180" "4.186.142.195" "4.186.142.214" "4.186.142.246" "5.181.175.105" "3.33.142.50" "6.5.5.0" Potential IP "4.0.0.0" found in string "guration,4.0.0.0,,b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "ion=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>", "0.200.169.204", "04.198.155.173", "04.200.151.35", "09.145.173.169", "09.226.37.172", "09.74.154.90", "09.74.154.91", "09.74.154.92", "40.228.21.36", "49.88.111.79", "54.61.71.50", "54.61.71.51", "72.105.89.202", "74.7.32.199", "76.63.4.179", "78.239.165.70", "81.214.153.11", "85.220.101.107", "85.44.176.125", "85.44.176.135", "85.44.176.143", "85.44.176.70", "85.44.176.85", "85.44.177.132", "85.44.177.133", "85.44.177.138", "85.44.177.193", "85.44.177.254", "85.44.177.55", "88.105.165.80", "88.105.71.44", "88.105.91.116", "88.105.91.143", "88.105.91.173", "91.101.209.39", "91.96.150.218", "92.211.110.74", "92.40.57.234", "92.87.28.103", "93.128.114.45", "93.225.193.201", "93.226.177.40", "94.110.13.70", "94.154.78.144", "94.154.78.152", "94.154.78.160", "94.154.78.169", "94.154.78.179", "94.154.78.210", "94.154.78.227", "94.154.78.230", "94.154.78.235", "94.154.78.77", "94.154.78.91", "94.186.142.178", "94.186.142.180", "94.186.142.183", "94.186.142.195", "94.186.142.204", "94.186.142.214", "94.186.142.236", "94.186.142.246", "95.181.175.103", "95.181.175.105", "95.228.105.39", "95.239.51.3", "95.239.51.42", "95.239.51.46", "95.239.51.59", "95.239.51.65", "95.239.51.73", "95.239.51.80", "95.239.51.89", "95.68.142.20", "95.68.142.3", "95.74.76.222", "0.114.22.115", "0.99.160.173", "04.101.161.31", "04.101.161.32", "07.102.138.83", "07.102.138.93", "08.78.41.115", "09.127.189.74", "12.119.227.136", "12.119.227.151", "12.119.227.167", "12.119.227.179", "12.119.227.184", "12.41.6.23", "13.33.142.50", "13.33.190.109", "13.33.190.118", "13.33.190.171", "13.33.190.22", "13.33.190.227", "13.33.190.242", "13.33.190.35", "13.33.190.42", "13.33.190.46", "13.33.190.69", "13.33.190.74", "3.128.248.46", "4.105.0.27", "4.105.183.68", "4.105.72.241", "4.138.255.104", "4.138.96.23", "4.141.146.114", "4.141.245.25", "4.142.74.220", "4.145.195.58", "4.145.89.174", "4.17.49.70", "4.17.55.59", "4.253.248.228", "4.73.60.153", "4.83.46.130", "4.85.243.241", "4.85.253.170", "5.186.33.204", "5.192.93.107", "5.197.127.11", "5.199.6.13", "5.229.69.227", "5.237.47.12", "8.154.242.210", "5.8.148.171", "2.250.30.131", "4.124.12.162", "7.218.111.202", "8.139.8.50", "9.104.209.109", "9.104.209.168", "9.104.209.172", "9.104.209.221", "9.104.209.231", "9.104.209.24", "9.104.209.249", "9.104.209.33", "9.104.209.36", "9.104.209.66", "0.211.0.97", "1.181.60.60", "4.147.54.113", "4.147.54.61", "4.147.56.249", "4.147.60.41", "4.147.60.52", "4.147.61.28", "4.147.62.12", "4.147.63.171", "4.147.63.236", "4.57.183.108", "4.57.200.69", "7.166.48.65", "7.166.50.1", "7.166.50.213", "7.166.51.209", "8.132.225.100", "8.132.226.203", "8.132.227.238", "8.132.231.71", "8.153.199.169", "8.64.35.141", "8.64.36.101", "8.66.107.75", "8.66.111.235", "8.66.8.175", "8.67.131.90", "8.67.134.91", "8.86.117.130", "9.208.29.106", "9.208.29.108", "9.208.29.140", "9.208.29.149", "9.208.29.63", "9.208.29.64", "9.208.29.95", "9.208.29.96", "9.208.29.97", "9.208.29.98", "2.211.109.160", "2.211.192.144", "2.211.52.62", "2.211.55.199", "3.216.75.209", "5.25.204.90", "5.25.71.112", "5.25.71.12", "5.25.71.5", "5.25.71.64", "5.25.71.65", "5.25.71.70", "5.25.71.80", "5.25.71.86", "5.25.71.87", "5.25.71.89", "5.25.71.92", "5.25.81.24", "192.168.0.2", Potential IP "4.0.0.0" found in string "ersion=4.0.0.0 Culture=neutral Pub", Potential IP "4.0.0.0" found in string "=4.0.0.0 Culture=neutral PublicKey", "9.17.5.1"51:Tae9,Pattern match: "https://discord.com/api/v9/users/@me" Pattern match: "https://www.phantomsoftwares.site/logo/phantom_discord.png" Pattern match: "https://t.me/oldphantomoftheopera" Heuristic match: "chrome_xmr.pt" Pattern match: "https://t.me/oldphantomoftheopera\n\n" Pattern match: "https://api.tele" Pattern match: "gram.org/bot" Pattern match: "http://icanhazip" Pattern match: "discord.com/api/v9/users/@me" Pattern match: "www.phantomsoftwares.site/logo/phantom_discord.png" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "system.st" Heuristic match: "ystem.windows.fo" Heuristic match: "tem.pg" Heuristic match: "

5__2" (Indicator: "zipfile"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "5__2" (Indicator: "base64"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "DecryptBase64" (Indicator: "base64"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "BCRYPT_AES_ALGORITHM" (Indicator: "aes"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "AesManaged" (Indicator: "aes"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "FromBase64String" (Indicator: "base64"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "zipFilePath" (Indicator: "zipfile"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "CryptoStream" (Indicator: "cryptostream"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "AesGcm" (Indicator: "aes"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[-] Invalid Base64 format" (Indicator: "base64"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "base64" (Indicator: "base64"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "description="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003516.00000000.67374.01210000.00000004.mdmp, 00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp") Found string "-] Invalid Base64 format" (Indicator: "base64"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "aeS)g" (Indicator: "aes"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "5__2" (Indicator: "zipfile"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "5__2" (Indicator: "base64"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "DecryptBase64" (Indicator: "base64"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "BCRYPT_AES_ALGORITHM" (Indicator: "aes"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "AesManaged" (Indicator: "aes"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp")57:Tb3b,Found reference to API "GetModuleHandle64" (Indicator: "GetModuleHandle"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "NtWow64QueryInformationProcess64" (Indicator: "QueryInformationProcess"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "GetModuleHandle64" (Indicator: "GetModuleHandle"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "NtWow64QueryInformationProcess64" (Indicator: "QueryInformationProcess"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp")58:T523,Found reference to API "GetModuleHandle64" (Indicator: "GetModuleHandle"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "GetModuleHandle64" (Indicator: "GetModuleHandle"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp")59:T409,Found reference to API "GetProcAddress64" (Indicator: "GetProcAddress"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "LdrGetProcedureAddress" (Indicator: "LdrGetProcedureAddress"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "GetProcAddress64" (Indicator: "GetProcAddress"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "LdrGetProcedureAddress" (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp")5a:T5b7,Found reference to API "GetTempPath" (Indicator: "GetTempPath"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002996.00000000.75872.FFA21000.00000020.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "Win32API|File Installation Library Functions|GetFileVersionInfo" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp, 00000000-00003516.00000003.76746.1D170000.00000004.mdmp")5b:T4ea,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp")5c:Te66,Found string "_password" (Indicator: "password"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "Mailpassword" (Indicator: "password"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "password_hex" (Indicator: "password"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "password" (Indicator: "password"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "password-check" (Indicator: "password"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "Gecko_passwords_" (Indicator: "password"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "Wifi - GetPassword: Failed to retrieve password for profile '" (Indicator: "password"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "- Saved networks with passwords:" (Indicator: "password"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "No WinSCP sessions found or master password is enabled." (Indicator: "password"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "password_value" (Indicator: "password"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "Chromium_passwords_" (Indicator: "password"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "passwords_" (Indicator: "password"; File: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "- GetPassword: Failed to retrieve password for profile '" (Indicator: "password"; File: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "works with passwords:" (Indicator: "password"; File: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "SCP sessions found or master password is enabled." (Indicator: "password"; File: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "hromium_passwords_" (Indicator: "password"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "ecko_passwords_" (Indicator: "password"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "ifi - GetPassword: Failed to retrieve password for profile '" (Indicator: "password"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "Saved networks with passwords:" (Indicator: "password"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "o WinSCP sessions found or master password is enabled." (Indicator: "password"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "_password" (Indicator: "password"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "Mailpassword" (Indicator: "password"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "password_hex" (Indicator: "password"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp")5d:T5bc,"Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe "Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" in Source: 60001dc-Outlook~GrabOutlook "Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" in Source: 60001dc-Outlook~GrabOutlook "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676" in Source: 60001dc-Outlook~GrabOutlook "\\Thunderbird\\Profiles" in Source: 60001e9-cctor "Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "urrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "oftware\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "oftware\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp "oftware\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp5e:Tb3d,Found string "[TAB]" (Indicator: "[tab]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[BACKSPACE]" (Indicator: "[BACKSPACE]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[DELETE]" (Indicator: "[Delete]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[ESC]" (Indicator: "[esc]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[PAGEUP]" (Indicator: "[PageUp]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[PAGEDOWN]" (Indicator: "[Pagedown]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[END]" (Indicator: "[end]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[HOME]" (Indicator: "[home]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[LEFT]" (Indicator: "[left]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[RIGHT]" (Indicator: "[right]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[DOWN]" (Indicator: "[down]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[PRINTSCREEN]" (Indicator: "[PrintScreen]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[INSERT]" (Indicator: "[insert]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[NUMLOCK]" (Indicator: "[NumLock]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[SCROLLLOCK]" (Indicator: "[ScrollLock]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[CTRL]" (Indicator: "[ctrl]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[CTRL]" (Indicator: "[Ctrl]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[ALT]" (Indicator: "[alt]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[ALT]" (Indicator: "[Alt]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[SHIFT]" (Indicator: "[shift]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[F10]" (Indicator: "[F10]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[F11]" (Indicator: "[F11]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "[F12]" (Indicator: "[F12]"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe")5f:Tc23,Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SELECT * FROM win32_operatingsystem" (Indicator: " Win32_OperatingSystem"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "Select * from AntivirusProduct" (Indicator: "antivirusproduct"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "Select * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found string "ECT * FROM win32_operatingsystem" (Indicator: " Win32_OperatingSystem"; File: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "om AntivirusProduct" (Indicator: "antivirusproduct"; File: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "ELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "ELECT * FROM win32_operatingsystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "elect * from AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "elect * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00003516.00000001.69295.01152000.00000020.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.1D170000.00000004.mdmp") Found string "Select * from AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp") Found string "CIM_PCVideoController" (Indicator: "CIM_PCVideoController"; Source: "00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp, 00000000-00003516.00000003.76746.1D170000.00000004.mdmp")60:T10ce,Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe") Found reference to API "AddAce" (Indicator: "AddAce"; File: "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe")61:Td41,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.691305D5.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.691305D5.bin]62:Td46,"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "")63:Te83,Found string "CreateFileMappingA" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: KERNEL32.DLL) Found string "CredReadW" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: ADVAPI32.DLL) Found string "OpenServiceW" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: SECHOST.DLL) Found string "GetFinalPathNameByHandleW" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: KERNELBASE.DLL) Found string "QueryFullProcessImageNameW" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: KERNEL32.DLL) Found string "ChangeServiceConfigW" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: SECHOST.DLL) Found string "CreateProcessWithTokenW" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: ADVAPI32.DLL) Found string "OpenSCManagerW" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: SECHOST.DLL) Found string "CreateProcessW" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: KERNEL32.DLL) Found string "GlobalAlloc" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: KERNELBASE.DLL) Found string "VirtualAlloc" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadId" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: KERNELBASE.DLL) Found string "NtSuspendThread" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: NTDLL.DLL) Found string "GetExitCodeThread" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: KERNELBASE.DLL) Found string "NtResumeThread" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: NTDLL.DLL) Found string "CreateRemoteThread" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: KERNELBASE.DLL) Found string "GetProcessIdOfThread" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: KERNELBASE.DLL) Found string "NtQueryInformationThread" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: NTDLL.DLL) Found string "NtGetNextThread" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: NTDLL.DLL) Found string "GetMethod" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: WMINET_UTILS.DLL) Found string "CredFree" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: ADVAPI32.DLL) Found string "GlobalFree" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: KERNELBASE.DLL) Found string "VirtualFree" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: KERNELBASE.DLL) Found string "CloseServiceHandle" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: SECHOST.DLL) Found string "LdrGetDllHandle" (Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe, API is part of module: NTDLL.DLL)64:T729,Found string "\HAPUBWS-PC\root\CIMV2:Win32_VideoController.DeviceID="VideoController1"" (Indicator: "root\cimv2"; in Source: "00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.1D170000.00000004.mdmp") Found string "\HAPUBWS-PC\root\CIMV2:Win32_Processor.DeviceID="CPU0"" (Indicator: "root\cimv2"; in Source: "00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp") Found string "\\HAPUBWS-PC\root\CIMV2:Win32_VideoController.DeviceID="VideoController1"" (Indicator: "root\cimv2"; in Source: "00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp") Found string "\\HAPUBWS-PC\root\CIMV2:Win32_OperatingSystem=@" (Indicator: "root\cimv2"; in Source: "00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp, 00000000-00003516.00000003.76746.1D170000.00000004.mdmp") Found string "\HAPUBWS-PC\root\CIMV2:Win32_OperatingSystem=@" (Indicator: "root\cimv2"; in Source: "00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp, 00000000-00003516.00000003.76746.1D170000.00000004.mdmp") Found string "root\CIMV2" (Indicator: "root\cimv2"; in Source: "00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp, 00000000-00003516.00000003.76746.1D170000.00000004.mdmp")65:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790555508973,"unified_at":"2026-09-28T00:31:48.973Z","metadata":{"hashes":{"sha256":"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece","sha1":"972a5a39e24cb820b5a2c08e600ffe80c261e5f3","md5":"25596412be7a34c82c30f4652ae38cf3","sha512":"fc1bf9ac8de203c4713848edd46179dea11710428bd3f0d20ae04aa69f5dc75c6ef740f939753cc3169f77908b6df45ff39752df44f154316493e1189a772bb1","ssdeep":"12288:w977l/7kqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQabdLdlLUwi:w9ZkqjVnlqud+/2P+ATAS/JYellLUx","ssdeep_chunks":["12288:w977l/7","12288:977l/7k","12288:77l/7kq","12288:7l/7kqj","12288:l/7kqjV","12288:/7kqjVn","12288:7kqjVnl","12288:kqjVnl3","12288:qjVnl36","12288:jVnl36u","12288:Vnl36ud","12288:nl36ud0","12288:l36ud0z","12288:36ud0zR","12288:6ud0zR/","12288:ud0zR/6","12288:d0zR/6C","12288:0zR/6Ct","12288:zR/6CtQ","12288:R/6CtQ9","12288:/6CtQ9P","12288:6CtQ9PU","12288:CtQ9PUH","12288:tQ9PUHI","12288:Q9PUHIG","12288:9PUHIG8","12288:PUHIG8D","12288:UHIG8DX","12288:HIG8DXj","12288:IG8DXjA","12288:G8DXjAG","12288:8DXjAGq","12288:DXjAGq2","12288:XjAGq2a","12288:jAGq2am","12288:AGq2amJ","12288:Gq2amJY","12288:q2amJYe","12288:2amJYeQ","12288:amJYeQa","12288:mJYeQab","12288:JYeQabd","12288:YeQabdL","12288:eQabdLd","12288:QabdLdl","12288:abdLdlL","12288:bdLdlLU","12288:dLdlLUw","12288:LdlLUwi","24576:w977l/7","24576:977l/7k","24576:77l/7kq","24576:7l/7kqj","24576:l/7kqjV","24576:/7kqjVn","24576:7kqjVnl","24576:kqjVnl3","24576:qjVnl36","24576:jVnl36u","24576:Vnl36ud","24576:nl36ud0","24576:l36ud0z","24576:36ud0zR","24576:6ud0zR/","24576:ud0zR/6","24576:d0zR/6C","24576:0zR/6Ct","24576:zR/6CtQ","24576:R/6CtQ9","24576:/6CtQ9P","24576:6CtQ9PU","24576:CtQ9PUH","24576:tQ9PUHI","24576:Q9PUHIG","24576:9PUHIG8","24576:PUHIG8D","24576:UHIG8DX","24576:HIG8DXj","24576:IG8DXjA","24576:G8DXjAG","24576:8DXjAGq","24576:DXjAGq2","24576:XjAGq2a","24576:jAGq2am","24576:AGq2amJ","24576:Gq2amJY","24576:q2amJYe","24576:2amJYeQ","24576:amJYeQa","24576:mJYeQab","24576:JYeQabd","24576:YeQabdL","24576:eQabdLd","24576:QabdLdl","24576:abdLdlL","24576:bdLdlLU","24576:dLdlLUw","24576:LdlLUwi","12288:w9ZkqjV","12288:9ZkqjVn","12288:ZkqjVnl","12288:kqjVnlq","12288:qjVnlqu","12288:jVnlqud","12288:Vnlqud+","12288:nlqud+/","12288:lqud+/2","12288:qud+/2P","12288:ud+/2P+","12288:d+/2P+A","12288:+/2P+AT","12288:/2P+ATA","12288:2P+ATAS","12288:P+ATAS/","12288:+ATAS/J","12288:ATAS/JY","12288:TAS/JYe","12288:AS/JYel","12288:S/JYell","12288:/JYellL","12288:JYellLU","12288:YellLUx"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":749568,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1761244354000,"last_seen":1762850729000,"last_multi_scan":1762850729000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["heracles","infostealer","evasive"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":93},"sandbox_signatures":{"informative_count":230,"suspicious_count":7,"malicious_count":5,"total":242},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/MSIL.Stealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.77707350","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_MSIL_Heracles_SPPX_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.77707350 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Spy.Agent.DRY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Malware.Win32.Gen.tr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDropper/MSIL.Injector.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000201 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/MsilInj-G","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.MUE.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.InfoStealer.gen.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_59.9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Able to access control system service controller"},{"type":"informative","value":"Contains ability to control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Contains ability to access the loader directly (API string)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"},{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"malicious","value":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Contains reference to shellcode"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES encryption (Dotnet String)"},{"type":"informative","value":"YARA signature match – ROR algorithm"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to perform AES cryptographic operations (Dotnet)"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to encrypt/decrypt data using TripleDES"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Able to detect if debugger is present"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - High entropy file"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve system configuration"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to discover operating system information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve user privileges"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve network adapter information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Creates directory on disk"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Queries list of installed browsers"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Contains ability to perform email related activity (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Command and Control","technique":"File Transfer Protocols","attack_id":"T1071.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/002","identifiers":[{"type":"informative","value":"Able to communicate using FTP protocol (.NET)"},{"type":"informative","value":"Dotnet code contains ability to perform FTP request"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to transfer files using SCP"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"IP stream initialized with maximum compression.\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"NtCreateThreadEx\" (Indicator: \"NtCreateThread\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found reference to API \"NtCreateThreadEx\" (Indicator: \"NtCreateThread\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetLastWriteTime\" (Indicator: \"SetLastWriteTime\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"SetCreationTime\" (Indicator: \"SetCreationTime\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"SetLastAccessTime\" (Indicator: \"SetLastAccessTime\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"SetLastWriteTime\" (Indicator: \"SetLastWriteTime\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found reference to API \"SetCreationTime\" (Indicator: \"SetCreationTime\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found reference to API \"SetLastAccessTime\" (Indicator: \"SetLastAccessTime\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe has big resource with name: \"costura.newtonsoft.json.dll.compressed\" size: \"269582\" and abnormal entropy:\"7.990512286183198\"\n 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe has big resource with name: \"costura.icsharpcode.sharpziplib.dll.compressed\" size: \"87671\" and abnormal entropy:\"7.9946103117851495\"\n 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe has big resource with name: \"costura.icsharpcode.sharpziplib.pdb.compressed\" size: \"48919\" and abnormal entropy:\"7.989400848938916\"\n 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe has big resource with name: \"costura.system.diagnostics.diagnosticsource.dll.compressed\" size: \"18664\" and abnormal entropy:\"7.987564040690493\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Able to detect if debugger is present","description":"Observed API \"NtQueryInformationProcess\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1622","relevance":1,"id":"static-220","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"SystemQueryPerformanceCounterInformation\" (Indicator: \"QueryPerformanceCounter\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003516.00000000.67374.01210000.00000004.mdmp, 00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/decrypt data using TripleDES","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-486","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.AesGcm.CreateDecryptor\" in Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES encryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.AesManaged.SystemSecureDumpEncryptionInformation\" in Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-446","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003516.00000000.67374.01210000.00000004.mdmp, 00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesManaged\" and TypeReference \".ctor\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed namespace \"System.Security.Cryptography.TripleDESCryptoServiceProvider\" and TypeReference \".ctor\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.4599","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"www.youtube.com/watch?v=9bZkp7q19f0\" (Indicator: \"youtube.com\"; Source: \"00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"chcp 65001 && netsh wlan show profile | findstr All\" (File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"\" key=clear | findstr Key\" (File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"), Found string \"\\\" key=clear | findstr Key\" (File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"cp 65001 && netsh wlan show profile | findstr All\" (File: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found string \"hcp 65001 && netsh wlan show profile | findstr All\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found string \"key=clear | findstr Key\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed dotnet function \"EnumerateDirectories\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed dotnet function \"EnumerateFiles\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed dotnet function \"GetDirectories\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_MachineName\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found string \"lpMachineName\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found string \"get_Is64BitOperatingSystem\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found string \"GetDrives\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"DISMHOST.EXE.691305D5.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00003516-00000C2B-74598788\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003516-00000C2B-56000736\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003516-00000C2B-56002109\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp, 00000000-00003516.00000003.76746.1D170000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp, 00000000-00003516.00000003.76746.1D170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003516-00000C2B-69424282\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"NtQuerySystemInformation\" in file \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003516)\n \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called \"IsWow64Process\" with parameter \"3516\" - (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$32","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"GetEnvironmentVariables\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed function \"GetEnvironmentVariable\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_UserName\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed function \"get_MachineName\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed function \"get_Is64BitOperatingSystem\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")\n Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system configuration","description":"Found string \"SystemInfo >> GetPublicIP : Request error\\n\" (Indicator: \"systeminfo \"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-359","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at 25596412be7a34c82c30f4652ae38cf3-6000216-SharpInjector~GetProcessHandleWithRequiredRights\n Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at 25596412be7a34c82c30f4652ae38cf3-6000217-SharpInjector~IsProcess64Bit\n Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at 25596412be7a34c82c30f4652ae38cf3-60002c6-Utils~IsProcessAdmin\n Stub.NativeMethods::OpenProcessToken(System.IntPtr,System.UInt32,System.IntPtr&) at 25596412be7a34c82c30f4652ae38cf3-60002c7-Utils~IsProcessAdmin\n Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at 25596412be7a34c82c30f4652ae38cf3-60002cc-Utils~DupHandle\n Stub.NativeMethods::OpenProcess(System.UInt32,System.Boolean,System.UInt32) at 25596412be7a34c82c30f4652ae38cf3-60002cf-Utils~KillProcess","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$35","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" queries volume information of \"C:\\7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" at 00000000-00003516-00000046-4316603","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"ELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"set_UseShellExecute\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"DISMHOST.EXE.691305D5.bin\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003516)\n \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003516)\n \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\f50a4f0a077eb8fed5b7b1a263e93417 (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$37","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"$38","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$39","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"$3c","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindowFlags\" (Indicator: \"ShowWindow\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"ShowWindowFlags\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.set_StartInfo\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed function \"Process.Start\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003516)\n \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003516)\n \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" with parameter %TEMP%\\f50a4f0a077eb8fed5b7b1a263e93417 (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\VZ7XGPP1JP74WP6YB3NB\"\n Process 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe created mutex with name \"Global\\CLR_PerfMon_WrapMutex\"\n Process 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe created mutex with name \"VZ7XGPP1JP74WP6YB3NB\"\n Process 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe created mutex with name \"RasPbFile\"\n Process 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$3f","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"twitter\" (Indicator: \"twitter\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"paypal\" (Indicator: \"paypal\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$40","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$41","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at E7EC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FCEB0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at E89F0000\n \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at E94C0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FEDF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" was detected as \".NET\" and name: \"Library\"\n \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"DISMHOST.EXE.691305D5.bin\" was detected as \".NET\" and name: \"Library\"\n \"DISMHOST.EXE.691305D5.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SELECT * FROM Win32_VideoController\" (Source: 600001d-AntiAnalysis~SuspiciousGPU, Indicator: \"select * from win32_videocontroller\")\n \"SELECT * FROM win32_operatingsystem\" (Source: 6000268-SystemInfo~GetWindowsVersionName, Indicator: \"select * from win32_operatingsystem\")\n \"Select * from AntivirusProduct\" (Source: 600026c-SystemInfo~GetAntivirus, Indicator: \"select * from antivirusproduct\")\n \"SELECT * FROM Win32_Processor\" (Source: 600026f-SystemInfo~GetCpuName, Indicator: \"select * from win32_processor\")\n \"Select * From Win32_ComputerSystem\" (Source: 6000271-SystemInfo~GetRamAmount, Indicator: \"select * from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$43","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"DISMHOST.EXE.691305D5.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" has an executable section named \".text\"\n \"DISMHOST.EXE.691305D5.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"DISMHOST.EXE.691305D5.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$44","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"DISMHOST.EXE.691305D5.bin\" has high imagebase \"0x100000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"GetAntivirus\" (Indicator: \"antivirus\") in Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\n \"Antivirus:\" (Indicator: \"antivirus\") in Source: 7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\n \"\\n🛡️ Antivirus:\" (Indicator: \"antivirus\") in Source: 60000d4-DiscordSendLogsSendMessageInfoAsyncd__3~MoveNext\n \"\\nAntivirus:\" (Indicator: \"antivirus\") in Source: 6000100-Filemanager~CreateArchive\n \"Comodo\" (Indicator: \"comodo\") in Source: 60001e9-cctor","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$45","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\f50a4f0a077eb8fed5b7b1a263e93417\\%OSUSER%-PC_20251111_091624.png\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"AttachmentCollection\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found string \"get_Attachments\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found string \"Attachment\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"HAPUBWS-PC_20251111_091624.png\" has type \"PNG image data 1513 x 788 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\f50a4f0a077eb8fed5b7b1a263e93417\\%OSUSER%-PC_20251111_091624.png]- [targetUID: 00000000-00003516]\n \"dism.log\" has type \"Unicode text UTF-8 (with BOM) text with very long lines (316) with CRLF line terminators\"- [targetUID: 00000000-00003516]\n \"DISMHOST.EXE.691305D5.bin\" has type \"PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections\"- [targetUID: 00000000-00003516]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" queries basic process information of the \"C:\\Windows\\System32\\rsaenh.dll\" (UID: 3516)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called \"NtQueueApcThread\" (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to detect virtual environment","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll\"\n \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" touched file \"C:\\Windows\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.pdb\"\n \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" touched file \"C:\\Windows\\mscorlib.pdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\f50a4f0a077eb8fed5b7b1a263e93417\\%osuser%-pc_20251111_091624.png\"\n \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" writes file \"%temp%\\f50a4f0a077eb8fed5b7b1a263e93417\\%osuser%-pc_20251111_091624.png\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Able to communicate using FTP protocol (.NET)","description":"Found string \"FtpWebResponse\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.002","relevance":1,"id":"string-944","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003516-00000C2B-69284736\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003516-00000C2B-69271541\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00003516-00000C2B-71426122\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00003516-00000C2B-71426835\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"get_Headers\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to perform email related activity (Dotnet)","description":"$4e","origin":"Static Parser","mitre_attack_id":"T1071.003","relevance":1,"id":"static-160","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed namespace \"System.Net.Http\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed namespace \"System.Net.Http.Headers\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"\n Observed namespace \"System.Net.Security\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer files using SCP","description":"Observed string: \"SCP sessions found or master password is enabled.\" (Indicator: \"scp \") in Source: 00000000-00003516.00000001.69295.01152000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-577","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to \"SmtpServer Decrypted: '\" (Indicator: \"SmtpServer\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStreamAsync\" (Indicator: \"GetRequestStream\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetRequestStreamAsync\" (Indicator: \"GetRequestStreamAsync\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetRequestStreamAsync\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found reference to API \"GetRequestStreamAsync\" (Indicator: \"GetRequestStreamAsync\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"GetHostName\" (Indicator: \"gethostname\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00003516-00000C2B-69271541\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00003516-00000C2B-69293604\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00003516.00000000.67374.01630000.00000002.mdmp, 00000000-00003516.00000001.69295.01630000.00000002.mdmp, 00000000-00003516.00000002.71218.01630000.00000002.mdmp\")\n Found reference to API \"GetHostName\" (Indicator: \"gethostname\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Dotnet code contains ability to perform FTP request","description":"Observed TypeReference \"FtpWebResponse\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.002","relevance":1,"id":"static-149","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$50","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$51","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$52","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://discord.com\"\n Found HTTPS url \"https://www.phantomsoftwares.site\"\n Found HTTPS url \"https://t.me\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - High entropy file","description":"YARA signature to detect high entropy file file \"sample.bin\"\n YARA signature to detect high entropy file process \"00000000-00003516\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-605","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00003516\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm file \"sample.bin\"\n YARA signature for encryption algorithm process \"00000000-00003516\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – ROR algorithm","description":"YARA signature matched on R0R instruction used in file \"sample.bin\"\n YARA signature matched on R0R instruction used in file \"DISMHOST.EXE.691305D5.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-209","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$53","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$54","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"\\\" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\\\"\" (Indicator: \"--user-data-dir\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"ndbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"\" (Indicator: \"--user-data-dir\"; File: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\"), Found string \"--no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=\"\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"GetClipboardData\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"58359857024,4572,3024,,RtlGetVersion,NTDLL.dll,\"943:34:25.857\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp, 00000000-00003516.00000003.76746.1D170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00003516.00000000.67374.01210000.00000004.mdmp, 00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$55","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$56","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"get_ProcessName\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"41600878042,3020,3184,,GetAdaptersAddresses,Iphlpapi.dll,\"252:23:13.443\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00003516.00000001.69295.1D170000.00000004.mdmp, 00000000-00003516.00000002.71218.1D170000.00000004.mdmp, 00000000-00003516.00000003.76746.1D170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"Found reference to API \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-311","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessIdOfThread\" (Indicator: \"GetProcessId\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetProcessIdOfThread\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetEnvironmentVariables\" (Indicator: \"GetEnvironmentVariable\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found reference to API \"GetEnvironmentVariables\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 25596412be7a34c82c30f4652ae38cf3-60002c5-Utils~IsAdmin","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"Found string \"chcp 65001 && netsh wlan show profile | findstr All\" (Indicator: \"findstr \"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"\" key=clear | findstr Key\" (Indicator: \"findstr \"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"), Found string \"\\\" key=clear | findstr Key\" (Indicator: \"findstr \"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"cp 65001 && netsh wlan show profile | findstr All\" (Indicator: \"findstr \"; File: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found string \"hcp 65001 && netsh wlan show profile | findstr All\" (Indicator: \"findstr \"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found string \"key=clear | findstr Key\" (Indicator: \"findstr \"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"key3.db\" (Indicator: \"key3.db\"; in File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"key4.db\" (Indicator: \"key4.db\"; in File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"ServiceController\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found string \"ServiceControllerStatus\" (Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003516-00000C2B-57707673\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003516-00000C2B-58462242\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\rsaenh.dll\" (UID: 00000000-00003516)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003516.00000000.67374.01210000.00000004.mdmp, 00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp\")\n Found string \"Microsoft Windows 7 Professional |C:\\Windows|\\Device\\Harddisk0\\Partition2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Contains ability to control system service controller","description":"Observed function \"ServiceController\" in \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\"","origin":"Static Parser","mitre_attack_id":"T1569.002","relevance":1,"id":"static-117","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003516.00000001.69295.01210000.00000004.mdmp, 00000000-00003516.00000002.71218.01210000.00000004.mdmp, 00000000-00003516.00000003.76746.01210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002996.00000000.75872.FFA21000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$61","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$62","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to shellcode","description":"Found reference to API \"Couldnt set the shellcode memory as PAGE_EXECUTE_READWRITE!\" (Indicator: \"shellcode\"; File: \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\")\n Found reference to API \"et the shellcode memory as PAGE_EXECUTE_READWRITE!\" (Indicator: \"shellcode\"; File: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")\n Found reference to API \"ouldnt set the shellcode memory as PAGE_EXECUTE_READWRITE!\" (Indicator: \"shellcode\"; Source: \"00000000-00003516.00000001.69295.01152000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-468","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"HAPUBWS-PC_20251111_091624.png\" has type \"PNG image data 1513 x 788 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" has section name .text with entropy \"7.468855372367864\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/26 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DISMHOST.EXE.691305D5.bin\" has type \"PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections\"- [targetUID: 00000000-00003516]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$64","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"DISMHOST.EXE.691305D5.bin\" claimed CRC 141269 while the actual is CRC 786159","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetSecurityDescriptorDacl\n GetModuleFileNameW\n GetSystemDirectoryW\n GetProcAddress\n GetVersionExW\n FindResourceExW\n GetCommandLineW\n GetFileAttributesW\n OutputDebugStringA\n GetModuleHandleExW\n CreateThread\n GetTickCount\n LoadLibraryW\n VirtualProtect\n GetVersionExA\n CreateFileMappingW\n LoadLibraryExW\n Sleep\n UnhandledExceptionFilter\n OutputDebugStringW\n TerminateProcess\n CreateFileW\n GetModuleHandleW\n MapViewOfFile\n GetStartupInfoW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" claims program is from Sat Apr 2 03:27:46 2072","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/26 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop","description":"Stub.NativeMethods::CreateDesktopW(System.String,System.String,System.IntPtr,System.UInt32,Stub.InternalStructs/DESKTOP_ACCESS,System.IntPtr) at 25596412be7a34c82c30f4652ae38cf3-6000040-BrowserCrypto~GetAppBoundKey","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-8","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Contains ability to create/switch the desktop"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"name":"Spyware","details_count":5,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Contains ability to read clipboard data"},{"detail":"Found browser information locations related strings"},{"detail":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"name":"Stealer/Phishing","details_count":2,"details":[{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":81,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["heracles","infostealer","evasive"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6912f7a8df9e7dfe2a066ca8","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe","analysis_start_time":"2025-11-11T08:48:59+00:00","indicators_count":{"informative":230,"suspicious":68,"malicious":8},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}],"processes":[{"pid":3516,"ppid":0,"name":"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe","command_line":"","sha256":"7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece","normalized_path":"C:\\7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece.exe","uid":"00000000-00003516","icon":"$65"}],"all_imported_dlls":["msvcrt.dll","mscorlib.ni.dll","System.ni.dll","RpcRtRemote.dll","System.Net.Http.ni.dll","winnsi.dll","dhcpcsvc.dll","FWPUCLNT.DLL","clbcatq.dll","wbemcomn2.dll","wbemprox.dll","NapiNSP.dll","uxtheme.dll","WindowsCodecs.dll","kernel32.dll","ws2_32.dll","rpcss.dll","System.Configuration.ni.dll","ntdsapi.dll","nlaapi.dll","VxSSL64.dll","ole32.dll","clrjit.dll","WMINet_Utils.dll","GdiPlus.dll","sechost.dll","lpk.dll","usp10.dll","msctf.dll","System.Windows.Forms.ni.dll","wship6.dll","rasadhlp.dll","comctl32.dll","psapi.dll","mscoree.dll","KernelBase.dll","oleaut32.dll","imm32.dll","version.dll","cryptsp.dll","System.Management.ni.dll","wbemsvc.dll","mswsock.dll","winrnr.dll","winhttp.dll","cfgmgr32.dll","profapi.dll","wmiutils.dll","pnrpnsp.dll","rasman.dll","sspicli.dll","ucrtbase_clr0400.dll","ntdll.dll","rasapi32.dll","fltLib.dll","System.Core.ni.dll","System.Xml.ni.dll","nsi.dll","gdi32.dll","shlwapi.dll","bcrypt.dll","fastprox.dll","WSHTCPIP.DLL","webio.dll","diasymreader.dll","vcruntime140_clr0400.dll","cryptbase.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Drawing.ni.dll","nlssorting.dll","IPHLPAPI.DLL","dnsapi.dll","rtutils.dll","advapi32.dll","mscoreei.dll","clr.dll","dhcpcsvc6.dll","credssp.dll","rpcrt4.dll","api-ms-win-core-synch-l1-2-0.dll","rsaenh.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DISMHOST.EXE.691305D5.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"name":"HAPUBWS-PC_20251111_091624.png","sha256":"471a1b9662a247339dd7ab49ba79492f2b6941f1849fa59ddb57cdc8471f569e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"name":"dism.log","sha256":"4706c6f62e2924cd88340fe388bae368fe4ddf2b8bc8f03d1c2e6ddd65586859","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{75AE3521-B756-4B3A-B364-4F4E2116BBF1}","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"path":"%TEMP%\\f50a4f0a077eb8fed5b7b1a263e93417\\%OSUSER%-PC_20251111_091624.png","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\VZ7XGPP1JP74WP6YB3NB","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"name":"VZ7XGPP1JP74WP6YB3NB","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6912f7a8df9e7dfe2a066ca8"}]}]}},"report_ids":{"sandbox_job_ids":["6912f7a8df9e7dfe2a066ca8"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 7d7789f9e302… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7d7789f9e302…. Malware family: Trojan.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 5 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 7d7789f9e302… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7d7789f9e302…. Malware family: Trojan.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 5 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7d7789f9e30220d886bf7c37f3dbc7be0adc361a451ffad333e087ee72d92ece"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 7d7789f9e302… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7d7789f9e302…. Malware family: Trojan.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 5 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L66","11",{}]]