21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 56:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T50f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious SupportScam_Win32_Screwon_PRP_MTB Sample 8541a01b5cab… — Score 81/100 — Hybrid Analysis","description":"Malicious verdict for sample 8541a01b5cab…. Malware family: SupportScam_Win32_Screwon_PRP_MTB. Threat score 81/100. 4/26 AV engines flagged this file. 2 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2","keywords":["Malicious","SupportScam_Win32_Screwon_PRP_MTB","malware analysis","sandbox report","threat intelligence","8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2"],"about":{"@type":"SoftwareApplication","name":"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2","additionalType":"Malicious sample"},"threatScore":81,"malwareFamily":"SupportScam_Win32_Screwon_PRP_MTB","antivirusDetections":{"malicious":4,"total":26},"behavioralIndicators":{"malicious":2,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T9ba,Heuristic match: "system.gc.name" Pattern match: "https://aka.ms/dotnet/download" Pattern match: "https://aka.ms/dotnet/info" Pattern match: "https://aka.ms/dotnet/app-launch-failedto" Pattern match: "https://aka.ms/dotnet/sdk-not-found" Pattern match: "https://aka.ms/dotnet-core-applaunch" Pattern match: "https://aka.ms/dotnet/app-launch-failed" Pattern match: "https://aka.ms/dotnet/app-launch-failedwould" Pattern match: "https://trustconnectsoftware.com/api,installtoken:qbt4muah2hjfuy4gzlgi5uaomwpzfa0x,organizationid" Heuristic match: "trustconnectsoftware.com" Pattern match: "https://tools.ietf.org/html/rfc9110#section-15.5.5,title:not" Pattern match: "https://github.com/dotnet/runtime" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/primarycps.htm0@" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "aka.ms/dotnet-warnings/{0" Pattern match: "https://aka.ms/binaryformatter" Pattern match: "https://aka.ms/serializationformat-binary-obsolete" Pattern match: "https://aka.ms/dotnet-warnings/{0" Heuristic match: "zh.ke" Pattern match: "microsoft.extensions.configuration.json/release/net8.0/microsoft.extensions.configuration.json.pdb" Heuristic match: "'[.bn" Heuristic match: "microsoft.extensions.options.ioptionschangetokensource.name" Heuristic match: "vf.mr" Pattern match: "https://docs.microsoft.com/dotnet/api/system.text.json.serialization.jsonnumberhandling" Heuristic match: "+*.sy" Pattern match: "https://github.com/mono/linker/issues/1731" Pattern match: "https://github.com/mono/linker/issues/1895v" Pattern match: "https://github.com/dotnet/runtime/issues/50821" Pattern match: "https://socks4:/" Heuristic match: "pi.cx"23:T3c95,Found XOR loop in file "ScreenConnect.Windows.dll" at offset 51969; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 788350; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 807416; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 812588; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1545596; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1725775; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 403576; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 465733; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 478581; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 504048; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 663646; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 663651; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 786889; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 794498; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 794627; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 846261; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 858997; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 884520; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 987345; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1041092; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1041832; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1042211; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1042652; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1043037; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1107281; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1116368; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1116416; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1116472; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1336432; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1451611; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1640308; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 48997; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 466360; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 479208; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 492475; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 498971; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 499107; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 516578; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 534139; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 665978; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 717797; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 846888; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 859624; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 872947; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 879443; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 879579; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 897050; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 904940; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 917290; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 946038; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1020210; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1099794; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1134901; code bytes = 8030 Found XOR loop in file "ScreenConnect.Windows.dll" at offset 1725756; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 703672; code bytes = 30d0 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 703696; code bytes = 30d0 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 377003; code bytes = 33c1 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 488400; code bytes = 33c1 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 357925; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 626720; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 852672; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 852919; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsCredentialProvider.dll" at offset 854505; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 166104; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 232607; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 269790; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 357532; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 366956; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 602342; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 605131; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsClient.exe" at offset 605378; code bytes = 8030 Found XOR loop in file "ScreenConnect.Core.dll" at offset 90139; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Core.dll" at offset 93233; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Core.dll" at offset 386691; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Core.dll" at offset 64108; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 178288; code bytes = 30d0 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 34912; code bytes = 33c1 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 161775; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 204180; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 245446; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 245693; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 247440; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsAuthenticationPackage.dll" at offset 255955; code bytes = 8030 Found XOR loop in file "ScreenConnect.Client.dll" at offset 149217; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Client.dll" at offset 162809; code bytes = 30d0 Found XOR loop in file "ScreenConnect.Client.dll" at offset 66902; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Client.dll" at offset 179315; code bytes = 33c1 Found XOR loop in file "ScreenConnect.Client.dll" at offset 44080; code bytes = 8030 Found XOR loop in file "ScreenConnect.Client.dll" at offset 83928; code bytes = 8030 Found XOR loop in file "ScreenConnect.Client.dll" at offset 153780; code bytes = 8030 Found XOR loop in file "ScreenConnect.Client.dll" at offset 164732; code bytes = 8030 Found XOR loop in file "ScreenConnect.Client.dll" at offset 166764; code bytes = 8030 Found XOR loop in file "ScreenConnect.Client.dll" at offset 167260; code bytes = 8030 Found XOR loop in file "ScreenConnect.Client.dll" at offset 191516; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 48094; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 50855; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 51407; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 51635; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 52919; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 53351; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.WindowsInstaller.dll" at offset 53441; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientService.exe" at offset 7051; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientService.exe" at offset 7874; code bytes = 33c1 Found XOR loop in file "ScreenConnect.ClientService.exe" at offset 83352; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientService.exe" at offset 87782; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientService.exe" at offset 90572; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientService.exe" at offset 90819; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 53820; code bytes = 33c1 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 53864; code bytes = 33c1 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 53892; code bytes = 33c1 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 53936; code bytes = 33c1 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 29003; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 73958; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 76747; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsFileManager.exe" at offset 76994; code bytes = 8030 Found XOR loop in file "ScreenConnect.ClientService.dll" at offset 1380; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsBackstageShell.exe" at offset 8595; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsBackstageShell.exe" at offset 53478; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsBackstageShell.exe" at offset 56268; code bytes = 8030 Found XOR loop in file "ScreenConnect.WindowsBackstageShell.exe" at offset 56515; code bytes = 8030 Found XOR loop in file "Microsoft.Deployment.Compression.dll" at offset 11797; code bytes = 8030 Found XOR loop in file "MSI5B8B.tmp" at offset 142503; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 283146; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 343067; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 370574; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 393912; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 427425; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 431498; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 444337; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 512846; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 517401; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 633033; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 653903; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 738228; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 804643; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 1040893; code bytes = 30d0 Found XOR loop in file "MSI5B8B.tmp" at offset 135039; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 181854; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 201649; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 214885; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 243911; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 328033; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 338549; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 371804; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 388257; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 477675; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 491239; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 549545; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 677467; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 696619; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 743924; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 786440; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 804655; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 1000711; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 1041286; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 1072817; code bytes = 33c1 Found XOR loop in file "MSI5B8B.tmp" at offset 55327; code bytes = 8030 Found XOR loop in file "MSI5B8B.tmp" at offset 113155; code bytes = 8030 Found XOR loop in file "MSI5B8B.tmp" at offset 135732; code bytes = 8030 Found XOR loop in file "MSI5B8B.tmp" at offset 144210; code bytes = 8030 Found XOR loop in file "MSI5B8B.tmp" at offset 215270; code bytes = 8030 Found XOR loop in file "MSI5B8B.tmp" at offset 307133; code bytes = 8030 Found XOR loop in file "MSI5B8B.tmp" at offset 443156; code bytes = 8030 Found XOR loop in file "MSI5B8B.tmp" at offset 608318; code bytes = 8030 Found XOR loop in file "MSI5B8B.tmp" at offset 839117; code bytes = 8030 Found XOR loop in file "MSI5B8B.tmp" at offset 839296; code bytes = 8030 Found XOR loop in file "MSI5B8B.tmp" at offset 961388; code bytes = 8030 Found XOR loop in file "MSI5B8B.tmp" at offset 975551; code bytes = 8030 Found XOR loop in file "MSI7282.tmp" at offset 203891; code bytes = 30d0 Found XOR loop in file "MSI7282.tmp" at offset 206671; code bytes = 30d0 Found XOR loop in file "MSI7282.tmp" at offset 204721; code bytes = 33c1 Found XOR loop in file "MSI7282.tmp" at offset 101287; code bytes = 8030 Found XOR loop in file "MSI7282.tmp" at offset 206652; code bytes = 8030 Found XOR loop in file "MSI71A5.tmp" at offset 203891; code bytes = 30d0 Found XOR loop in file "MSI71A5.tmp" at offset 206671; code bytes = 30d0 Found XOR loop in file "MSI71A5.tmp" at offset 204721; code bytes = 33c1 Found XOR loop in file "MSI71A5.tmp" at offset 101287; code bytes = 8030 Found XOR loop in file "MSI71A5.tmp" at offset 206652; code bytes = 803024:T537,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" touched "Windows Management and Instrumentation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}\TREATAS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")25:T188a,Contains base64 string in header "POST" in header "POST /api/agents/heartbeat HTTP/1.1Host: trustconnectsoftware.comTransfer-Encoding: chunkedContent-Type: application/json; charset=utf-8" Contains base64 string in header "trustconnectsoftware" in header "POST /api/agents/heartbeat HTTP/1.1Host: trustconnectsoftware.comTransfer-Encoding: chunkedContent-Type: application/json; charset=utf-8" Contains base64 string in header "Encoding" in header "POST /api/agents/heartbeat HTTP/1.1Host: trustconnectsoftware.comTransfer-Encoding: chunkedContent-Type: application/json; charset=utf-8" Contains base64 string in header "Type" in header "POST /api/agents/heartbeat HTTP/1.1Host: trustconnectsoftware.comTransfer-Encoding: chunkedContent-Type: application/json; charset=utf-8" Contains base64 string in header "application/json" in header "POST /api/agents/heartbeat HTTP/1.1Host: trustconnectsoftware.comTransfer-Encoding: chunkedContent-Type: application/json; charset=utf-8" Contains base64 string in header "POST" in header "POST /api/agents/register HTTP/1.1Host: trustconnectsoftware.comTransfer-Encoding: chunkedContent-Type: application/json; charset=utf-8" Contains base64 string in header "/api/agents/register" in header "POST /api/agents/register HTTP/1.1Host: trustconnectsoftware.comTransfer-Encoding: chunkedContent-Type: application/json; charset=utf-8" Contains base64 string in header "trustconnectsoftware" in header "POST /api/agents/register HTTP/1.1Host: trustconnectsoftware.comTransfer-Encoding: chunkedContent-Type: application/json; charset=utf-8" Contains base64 string in header "Encoding" in header "POST /api/agents/register HTTP/1.1Host: trustconnectsoftware.comTransfer-Encoding: chunkedContent-Type: application/json; charset=utf-8" Contains base64 string in header "Type" in header "POST /api/agents/register HTTP/1.1Host: trustconnectsoftware.comTransfer-Encoding: chunkedContent-Type: application/json; charset=utf-8" Contains base64 string in header "application/json" in header "POST /api/agents/register HTTP/1.1Host: trustconnectsoftware.comTransfer-Encoding: chunkedContent-Type: application/json; charset=utf-8" Contains base64 string in header "QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X" in header "GET /agent-update?version=6.1.0&token=QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X HTTP/1.1" Contains base64 string in header "480bf8f3" in header "GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Contains base64 string in header "7dbd" in header "GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Contains base64 string in header "497f" in header "GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Contains base64 string in header "82dd" in header "GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Contains base64 string in header "79caee6db621" in header "GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Contains base64 string in header "7dbd" in header "GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Contains base64 string in header "497f" in header "GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Contains base64 string in header "82dd" in header "GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Contains base64 string in header "79caee6db621" in header "GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Contains base64 string in header "480bf8f3" in header "GET /api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Contains base64 string in header "7dbd" in header "GET /api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Contains base64 string in header "497f" in header "GET /api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Contains base64 string in header "82dd" in header "GET /api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Contains base64 string in header "79caee6db621" in header "GET /api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Contains base64 string in header "480bf8f3" in header "GET /ws/screen?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1Host: trustconnectsoftware.comConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 2fQg5/YB/UqJfOPSDFsglA==Sec-WebSocket-Version: 13" Contains base64 string in header "7dbd" in header "GET /ws/screen?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1Host: trustconnectsoftware.comConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 2fQg5/YB/UqJfOPSDFsglA==Sec-WebSocket-Version: 13" Contains base64 string in header "497f" in header "GET /ws/screen?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1Host: trustconnectsoftware.comConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 2fQg5/YB/UqJfOPSDFsglA==Sec-WebSocket-Version: 13" Contains base64 string in header "82dd" in header "GET /ws/screen?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1Host: trustconnectsoftware.comConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 2fQg5/YB/UqJfOPSDFsglA==Sec-WebSocket-Version: 13" Contains base64 string in header "79caee6db621" in header "GET /ws/screen?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1Host: trustconnectsoftware.comConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 2fQg5/YB/UqJfOPSDFsglA==Sec-WebSocket-Version: 13" Contains base64 string in header "trustconnectsoftware" in header "GET /ws/screen?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1Host: trustconnectsoftware.comConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 2fQg5/YB/UqJfOPSDFsglA==Sec-WebSocket-Version: 13" Contains base64 string in header "websocketSec" in header "GET /ws/screen?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1Host: trustconnectsoftware.comConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 2fQg5/YB/UqJfOPSDFsglA==Sec-WebSocket-Version: 13" Contains base64 string in header "2fQg5/YB/UqJfOPSDFsglA==" in header "GET /ws/screen?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1Host: trustconnectsoftware.comConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 2fQg5/YB/UqJfOPSDFsglA==Sec-WebSocket-Version: 13"26:T592,Found registry modification API: "g____PInvoke|1_0" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry modification API: "g____PInvoke|2_0" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry modification API: "RegConnectRegistryW" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry modification API: "RegCreateKeyEx" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry modification API: "RegConnectRegistry" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry modification API: "RegConnectRegistryWTU" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry modification API: "RegCreateKeyExWTU" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp"27:T6ef,"ScreenConnect.Windows.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "ScreenConnect.WindowsCredentialProvider.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- [targetUID: 00000000-00007964] "ScreenConnect.Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "ScreenConnect.WindowsAuthenticationPackage.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- [targetUID: 00000000-00007964] "ScreenConnect.Client.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "Microsoft.Deployment.WindowsInstaller.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "ScreenConnect.ClientService.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "Microsoft.Deployment.WindowsInstaller.Package.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "Microsoft.Deployment.Compression.Cab.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "Microsoft.Deployment.Compression.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "ScreenConnect.InstallerActions.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964]28:T10a7,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")29:T1d51,Found string "RepositoryUrl!https://github.com/dotnet/runtime" (Indicator: "github.com"; Source: "00000000-00001144.00000000.119240.00420000.00000004.mdmp, 00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000000.119240.004D0000.00000004.mdmp, 00000000-00001144.00000000.119240.004E0000.00000004.mdmp, 00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.01301000.00000020.mdmp, 00000000-00001144.00000000.119240.01330000.00000004.mdmp, 00000000-00001144.00000000.119240.02370000.00000004.mdmp, 00000000-00001144.00000000.119240.02380000.00000004.mdmp, 00000000-00001144.00000000.119240.023A0000.00000004.mdmp, 00000000-00001144.00000000.119240.023C0000.00000004.mdmp, 00000000-00001144.00000000.119240.023D0000.00000004.mdmp, 00000000-00001144.00000000.119240.023F0000.00000004.mdmp, 00000000-00001144.00000000.119240.02400000.00000004.mdmp, 00000000-00001144.00000000.119240.02481000.00000020.mdmp, 00000000-00001144.00000000.119240.02541000.00000020.mdmp, 00000000-00001144.00000000.119240.02700000.00000004.mdmp, 00000000-00001144.00000000.119240.027D1000.00000020.mdmp, 00000000-00001144.00000000.119240.027F0000.00000004.mdmp, 00000000-00001144.00000000.119240.02820000.00000004.mdmp, 00000000-00001144.00000000.119240.02870000.00000004.mdmp, 00000000-00001144.00000000.119240.028B0000.00000004.mdmp, 00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000000.119240.04870000.00000004.mdmp, 00000000-00001144.00000000.119240.04951000.00000020.mdmp, 00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000000.119240.04F60000.00000004.mdmp, 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp, 00000000-00001144.00000000.119240.04FE0000.00000004.mdmp, 00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp, 00000000-00001144.00000001.121162.00470000.00000004.mdmp, 00000000-00001144.00000001.121162.00480000.00000004.mdmp, 00000000-00001144.00000001.121162.004B1000.00000020.mdmp, 00000000-00001144.00000001.121162.004F0000.00000004.mdmp, 00000000-00001144.00000001.121162.00540000.00000004.mdmp, 00000000-00001144.00000001.121162.00550000.00000004.mdmp, 00000000-00001144.00000001.121162.01320000.00000004.mdmp, 00000000-00001144.00000001.121162.02211000.00000020.mdmp, 00000000-00001144.00000001.121162.02250000.00000004.mdmp, 00000000-00001144.00000001.121162.02390000.00000004.mdmp, 00000000-00001144.00000001.121162.023B0000.00000004.mdmp, 00000000-00001144.00000001.121162.02410000.00000004.mdmp, 00000000-00001144.00000001.121162.02510000.00000004.mdmp, 00000000-00001144.00000001.121162.02570000.00000004.mdmp, 00000000-00001144.00000001.121162.02651000.00000020.mdmp, 00000000-00001144.00000001.121162.026E1000.00000020.mdmp, 00000000-00001144.00000001.121162.02710000.00000004.mdmp, 00000000-00001144.00000001.121162.02720000.00000004.mdmp, 00000000-00001144.00000001.121162.02730000.00000004.mdmp, 00000000-00001144.00000001.121162.02810000.00000004.mdmp, 00000000-00001144.00000001.121162.02850000.00000004.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.02930000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.04851000.00000020.mdmp, 00000000-00001144.00000001.121162.04890000.00000004.mdmp, 00000000-00001144.00000001.121162.04A11000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp, 00000000-00001144.00000001.121162.04F31000.00000020.mdmp, 00000000-00001144.00000001.121162.05370000.00000004.mdmp, 00000000-00001144.00000001.121162.053B0000.00000004.mdmp, 00000000-00001144.00000001.121162.05471000.00000020.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp, 00000000-00001144.00000001.121162.055D1000.00000020.mdmp, 00000000-00001144.00000001.121162.05600000.00000004.mdmp, 00000000-00001144.00000001.121162.05C40000.00000004.mdmp, 00000000-00001144.00000001.121162.05CB1000.00000020.mdmp, 00000000-00001144.00000001.121162.06031000.00000020.mdmp, 00000000-00001144.00000001.121162.062C1000.00000020.mdmp, 00000000-00001144.00000001.121162.06331000.00000020.mdmp, 00000000-00001144.00000002.123083.00450000.00000004.mdmp, 00000000-00001144.00000002.123083.004A0000.00000004.mdmp, 00000000-00001144.00000002.123083.004C0000.00000004.mdmp, 00000000-00001144.00000002.123083.00500000.00000004.mdmp, 00000000-00001144.00000002.123083.00520000.00000004.mdmp, 00000000-00001144.00000002.123083.00531000.00000020.mdmp, 00000000-00001144.00000002.123083.01200000.00000004.mdmp, 00000000-00001144.00000002.123083.024F1000.00000020.mdmp, 00000000-00001144.00000002.123083.02590000.00000004.mdmp, 00000000-00001144.00000002.123083.025B0000.00000004.mdmp, 00000000-00001144.00000002.123083.025C0000.00000004.mdmp, 00000000-00001144.00000002.123083.02781000.00000020.mdmp, 00000000-00001144.00000002.123083.02830000.00000004.mdmp, 00000000-00001144.00000002.123083.02840000.00000004.mdmp, 00000000-00001144.00000002.123083.02860000.00000004.mdmp, 00000000-00001144.00000002.123083.02891000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp, 00000000-00001144.00000002.123083.04810000.00000004.mdmp, 00000000-00001144.00000002.123083.04A30000.00000004.mdmp, 00000000-00001144.00000002.123083.04A61000.00000020.mdmp, 00000000-00001144.00000002.123083.04A90000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp, 00000000-00001144.00000002.123083.053A0000.00000004.mdmp, 00000000-00001144.00000002.123083.053C0000.00000004.mdmp, 00000000-00001144.00000002.123083.05610000.00000004.mdmp, 00000000-00001144.00000002.123083.05811000.00000020.mdmp, 00000000-00001144.00000002.123083.05C10000.00000004.mdmp, 00000000-00001144.00000002.123083.05C70000.00000004.mdmp, 00000000-00001144.00000002.123083.06050000.00000004.mdmp, 00000000-00001144.00000002.123083.06080000.00000004.mdmp, 00000000-00001144.00000002.123083.06111000.00000020.mdmp, 00000000-00001144.00000002.123083.061A0000.00000004.mdmp, 00000000-00001144.00000002.123083.062E0000.00000004.mdmp, 00000000-00001144.00000002.123083.06300000.00000004.mdmp, 00000000-00001144.00000002.123083.06361000.00000020.mdmp, 00000000-00001144.00000002.123083.06D00000.00000004.mdmp, 00000000-00001144.00000002.123083.06D51000.00000020.mdmp") Found string "_type is annotated as preserve All members, so any Types returned from GetInterfaces should be preserved as well once https://github.com/mono/linker/issues/1731 is fixed." (Indicator: "github.com"; Source: "00000000-00001144.00000000.119240.04951000.00000020.mdmp, 00000000-00001144.00000001.121162.04890000.00000004.mdmp") Found string "Calling _type.Assembly.GetType on a non-assembly qualified type will still work. See https://github.com/mono/linker/issues/1895v" (Indicator: "github.com"; Source: "00000000-00001144.00000000.119240.04951000.00000020.mdmp, 00000000-00001144.00000001.121162.04890000.00000004.mdmp") Found string "Justification\Suppressing the warning until gets fixed, see https://github.com/dotnet/runtime/issues/50821" (Indicator: "github.com"; Source: "00000000-00001144.00000000.119240.04951000.00000020.mdmp, 00000000-00001144.00000001.121162.04890000.00000004.mdmp")2a:T8be,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")2b:T411,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe")2c:T448,Found reference to API "GetExtendedTcpTable" (Indicator: "GetExtendedTcpTable"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API "GetExtendedUdpTable" (Indicator: "GetExtendedUdpTable"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API "g____PInvoke|54_0" (Indicator: "GetExtendedTcpTable"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API "g____PInvoke|56_0" (Indicator: "GetExtendedUdpTable"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp")2d:T8fa,Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.00420000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.004E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.01330000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.02370000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.02380000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.023A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.023C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.023D0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.023F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.02400000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.02700000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.027F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.02820000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.02870000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.028B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.04870000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.04F60000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.04FE0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000000.119240.05570000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000001.121162.00430000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001144.00000001.121162.00470000.00000004.mdmp")2e:Ta7a,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "g____PInvoke|3_0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found reference to API "g____PInvoke|4_0" (Indicator: "Process32First"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found reference to API "g____PInvoke|5_0" (Indicator: "Process32Next"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found reference to API "Process32FirstWT" (Indicator: "Process32First"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found reference to API "Process32NextWT" (Indicator: "Process32Next"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp")2f:T810,Found registry deletion API: "g____PInvoke|3_0" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry deletion API: "g____PInvoke|4_0" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry deletion API: "g____PInvoke|5_0" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry deletion API: "RegDeleteTreeW" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry deletion API: "RegDeleteTree" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry deletion API: "RegDeleteValue" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyEx" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyExWTU" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry deletion API: "RegDeleteTreeWTU" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry deletion API: "RegDeleteValueWTU" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp"30:T226c,Found reference to "he Rijndael and RijndaelManaged types are obsolete. Use Aes instead." (Indicator: "Aes"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "he Rijndael and RijndaelManaged types are obsolete. Use Aes instead." (Indicator: "Rijndael"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "he Rijndael and RijndaelManaged types are obsolete. Use Aes instead." (Indicator: "RijndaelManaged"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "NGCryptoServiceProvider is obsolete. To generate a random number, use one of the RandomNumberGenerator static methods instead." (Indicator: "RandomNumberGenerator"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "roduceLegacyHmacValues is obsolete. Producing legacy HMAC values is not supported." (Indicator: "HMAC"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "fc2898DeriveBytes.CryptDeriveKey is obsolete and is not supported. Use PasswordDeriveBytes.CryptDeriveKey instead." (Indicator: "DeriveBytes"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "fc2898DeriveBytes.CryptDeriveKey is obsolete and is not supported. Use PasswordDeriveBytes.CryptDeriveKey instead." (Indicator: "PasswordDeriveBytes"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "msSigner(CspParameters) is obsolete and is not supported. Use an alternative constructor instead." (Indicator: "CspParameters"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "ssemblyName members HashAlgorithm, ProcessorArchitecture, and VersionCompatibility are obsolete and not supported." (Indicator: "HashAlgorithm"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "he default hash algorithm and iteration counts in Rfc2898DeriveBytes constructors are outdated and insecure. Use a constructor that accepts the hash algorithm and the number of iterations." (Indicator: "DeriveBytes"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "he default hash algorithm and iteration counts in Rfc2898DeriveBytes constructors are outdated and insecure. Use a constructor that accepts the hash algorithm and the number of iterations." (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "CDiffieHellmanPublicKey.ToByteArray() and the associated constructor do not have a consistent and interoperable implementation on all platforms. Use ECDiffieHellmanPublicKey.ExportSubjectPublicKeyInfo() instead." (Indicator: "ECDiffieHellman"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "CDiffieHellmanPublicKey.ToByteArray() and the associated constructor do not have a consistent and interoperable implementation on all platforms. Use ECDiffieHellmanPublicKey.ExportSubjectPublicKeyInfo() instead." (Indicator: "ECDiffieHellmanPublicKey"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "CryptoConfigEncodeOIDDiagId" (Indicator: "CryptoConfig"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "RijndaelDiagId" (Indicator: "Rijndael"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "RNGCryptoServiceProviderDiagId" (Indicator: "RNGCryptoServiceProvider"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "AesGcmTagConstructorDiagId" (Indicator: "Aes"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "AesGcmTagConstructorDiagId" (Indicator: "AesGcm"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "CryptoConfigEncodeOIDMessage" (Indicator: "CryptoConfig"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "RijndaelMessage" (Indicator: "Rijndael"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "RNGCryptoServiceProviderMessage" (Indicator: "RNGCryptoServiceProvider"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "AesGcmTagConstructorMessage" (Indicator: "Aes"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "AesGcmTagConstructorMessage" (Indicator: "AesGcm"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001144.00000000.119240.02481000.00000020.mdmp, 00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000001.121162.02410000.00000004.mdmp, 00000000-00001144.00000002.123083.04A30000.00000004.mdmp, 00000000-00001144.00000002.123083.04A61000.00000020.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp, 00000000-00001144.00000002.123083.05610000.00000004.mdmp, 00000000-00001144.00000002.123083.05811000.00000020.mdmp") Found reference to "Aes192" (Indicator: "Aes"; Source: "00000000-00001144.00000000.119240.04F60000.00000004.mdmp, 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp") Found reference to "Aes256" (Indicator: "Aes"; Source: "00000000-00001144.00000000.119240.04F60000.00000004.mdmp, 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp") Found reference to "Aes128" (Indicator: "Aes"; Source: "00000000-00001144.00000000.119240.04F60000.00000004.mdmp, 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp") Found reference to "HashAlgorithmType" (Indicator: "HashAlgorithm"; Source: "00000000-00001144.00000000.119240.04F60000.00000004.mdmp, 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp, 00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000001.121162.05471000.00000020.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp, 00000000-00001144.00000002.123083.053C0000.00000004.mdmp")31:Ta5b,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp, 00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.02870000.00000004.mdmp, 00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000000.119240.04F60000.00000004.mdmp, 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp, 00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.02570000.00000004.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp, 00000000-00001144.00000001.121162.05471000.00000020.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp, 00000000-00001144.00000001.121162.06031000.00000020.mdmp, 00000000-00001144.00000001.121162.06331000.00000020.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp, 00000000-00001144.00000002.123083.01200000.00000004.mdmp, 00000000-00001144.00000002.123083.024F1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp, 00000000-00001144.00000002.123083.053C0000.00000004.mdmp, 00000000-00001144.00000002.123083.05610000.00000004.mdmp, 00000000-00001144.00000002.123083.05811000.00000020.mdmp, 00000000-00001144.00000002.123083.06050000.00000004.mdmp, 00000000-00001144.00000002.123083.06080000.00000004.mdmp, 00000000-00001144.00000002.123083.06111000.00000020.mdmp, 00000000-00001144.00000002.123083.06300000.00000004.mdmp, 00000000-00001144.00000002.123083.06C10000.00000004.mdmp, 00000000-00001144.00000002.123083.06D00000.00000004.mdmp, 00000000-00001144.00000002.123083.06D51000.00000020.mdmp, 00000000-00001144.00000002.123083.10AD8000.00000002.mdmp") Found reference to API "FUsesGetLastError" (Indicator: "GetLastError"; Source: "00000000-00001144.00000000.119240.027D1000.00000020.mdmp, 00000000-00001144.00000000.119240.027F0000.00000004.mdmp")32:T26ce,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000e4d0b7f9c600000078eeb7f9c6000000d4d0b7f9c60000000300000000000000000000000000000024f02cb8f87f00000000000000000000100000000000000000000000000000000000c9b0f67f000010000000000000006f5baac7f87f000078eeb7f9 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000020000281db6040302000000000000000000000300000000000000080001000302000078eeb7f9c600000050d3b7f9c6000000ffffffffffffffffc0d2b7f9c600000024f02cb8f87f0000000000000000000010000000000000000200000003020000000032b1f67f000010000000000000006f5baac7f87f000000000000 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000058d4b7f9c60000000000000000000000ffffffff00000000080001000302000078eeb7f9c600000058d4b7f9c6000000f8ddb7f9c6000000030000000000000024f02cb8f87f0000000000000000000010000000000000000100000000000000000000000000000010000000000000006f5baac7f87f0000ffffffff (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000e4d0b7f9c600000078eeb7f9c6000000d4d0b7f9c60000000300000000000000000000000000000024f02cb8f87f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5baac7f87f000078eeb7f9 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000020000b8a5b7040302000000000000000000000300000000000000080001000302000078eeb7f9c600000050d3b7f9c6000000ffffffffffffffffc0d2b7f9c600000024f02cb8f87f000000000000000000001000000000000000e0c6d0b0f67f0000000000000000000010000000000000006f5baac7f87f000000000000 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000058d4b7f9c60000000000000000000000ffffffff00000000080001000302000078eeb7f9c600000058d4b7f9c6000000f8ddb7f9c6000000030000000000000024f02cb8f87f000000000000000000001000000000000000b029251003020000000000000000000010000000000000006f5baac7f87f0000ffffffff (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000f4d0b7f9c600000078eeb7f9c6000000e4d0b7f9c60000000300000000000000000000000000000024f02cb8f87f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5baac7f87f000078eeb7f9 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000020000e8c2b8040302000000000000000000000300000000000000080001000302000078eeb7f9c600000060d3b7f9c6000000ffffffffffffffffd0d2b7f9c600000024f02cb8f87f000000000000000000001000000000000000ffffffffffffffff000026100302000010000000000000006f5baac7f87f000000000000 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000068d4b7f9c60000000000000000000000ffffffff00000000080001000302000078eeb7f9c600000068d4b7f9c6000000f8ddb7f9c6000000030000000000000024f02cb8f87f00000000000000000000100000000000000090e2261003020000000000000000000010000000000000006f5baac7f87f0000ffffffff (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000054e8cffbc6000000000000000000000044e8cffbc60000000300000000000000000000000000000024f02cb8f87f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5baac7f87f000000000000 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000002000068fbb504030200000000000000000000030000000000000008000100030200000000000000000000c0eacffbc6000000ffffffffffffffff30eacffbc600000024f02cb8f87f00000000000000000000100000000000000030eb0b1003020000000039b1f67f000010000000000000006f5baac7f87f000000000000 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000c8ebcffbc60000000000000000000000ffffffff0000000008000100030200000000000000000000c8ebcffbc6000000586f021003020000030000000000000024f02cb8f87f000000000000000000001000000000000000d88da41203020000000000000000000010000000000000006f5baac7f87f0000ffffffff (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000002000018b4b704030200000000000000000000030000000000000008000100030200000000000000000000c0eacffbc6000000ffffffffffffffff30eacffbc600000024f02cb8f87f0000000000000000000010000000000000000000803f00000000000000000000000010000000000000006f5baac7f87f000000000000 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000c8ebcffbc60000000000000000000000ffffffff0000000008000100030200000000000000000000c8ebcffbc6000000586f021003020000030000000000000024f02cb8f87f000000000000000000001000000000000000f0bda81203020000000000000000000010000000000000006f5baac7f87f0000ffffffff (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000064e8cffbc6000000000000000000000054e8cffbc60000000300000000000000000000000000000024f02cb8f87f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5baac7f87f000000000000 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000020000181bb604030200000000000000000000030000000000000008000100030200000000000000000000d0eacffbc6000000ffffffffffffffff40eacffbc600000024f02cb8f87f00000000000000000000100000000000000048db9010f77f000000005ae0f87f000010000000000000006f5baac7f87f000000000000 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000d8ebcffbc60000000000000000000000ffffffff0000000008000100030200000000000000000000d8ebcffbc6000000586f021003020000030000000000000024f02cb8f87f0000000000000000000010000000000000006877a91203020000000000000000000010000000000000006f5baac7f87f0000ffffffff (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000a4e4c7fac6000000000000000000000094e4c7fac60000000300000000000000000000000000000024f02cb8f87f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5baac7f87f000000000000 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000020000d84ac00403020000000000000000000003000000000000000800010003020000000000000000000010e7c7fac6000000ffffffffffffffff80e6c7fac600000024f02cb8f87f000000000000000000001000000000000000985d830f03020000000076b1f67f000010000000000000006f5baac7f87f000000000000 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000018e8c7fac60000000000000000000000ffffffff000000000800010003020000000000000000000018e8c7fac6000000a04d890f03020000030000000000000024f02cb8f87f00000000000000000000100000000000000050737e1203020000000000000000000010000000000000006f5baac7f87f0000ffffffff (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000002000018cbc30403020000000000000000000003000000000000000800010003020000000000000000000010e7c7fac6000000ffffffffffffffff80e6c7fac600000024f02cb8f87f0000000000000000000010000000000000005bafd0b0f67f00000000c7fac600000010000000000000006f5baac7f87f000000000000 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d580000020000000000000018e8c7fac60000000000000000000000ffffffff000000000800010003020000000000000000000018e8c7fac6000000a04d890f03020000030000000000000024f02cb8f87f0000000000000000000010000000000000002886851203020000000000000000000010000000000000006f5baac7f87f0000ffffffff (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetVersionExA" with parameter 940000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000b4e4c7fac60000000000000000000000a4e4c7fac60000000300000000000000000000000000000024f02cb8f87f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5baac7f87f000000000000 (UID: 00000000-00001144)33:T22ca,"GET /agent-update?version=6.1.0&token=QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X HTTP/1.1" Response ==> HTTP/1.1 204 No Content Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:25 GMT Connection: keep-alive with no response body "GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:25 GMT Content-Type: application/problem+json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B2274797065223A2268747470733A2F2F746F6F6C732E696574662E6F72672F68746D6C2F726663393131302373656374696F6E2D31352E352E35222C227469....... "GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 204 No Content Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:25 GMT Connection: keep-alive with no response body "GET /api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:25 GMT Content-Type: application/problem+json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B2274797065223A2268747470733A2F2F746F6F6C732E696574662E6F72672F68746D6C2F726663393131302373656374696F6E2D31352E352E35222C227469....... "GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:30 GMT Content-Type: application/problem+json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B2274797065223A2268747470733A2F2F746F6F6C732E696574662E6F72672F68746D6C2F726663393131302373656374696F6E2D31352E352E35222C227469....... "GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 204 No Content Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:30 GMT Connection: keep-alive with no response body "GET /ws/screen?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1 Host: trustconnectsoftware.com Connection: Upgrade Upgrade: websocket Sec-WebSocket-Key: 2fQg5/YB/UqJfOPSDFsglA== Sec-WebSocket-Version: 13" Response ==> HTTP/1.1 101 Switching Protocols Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:34 GMT Connection: upgrade Upgrade: websocket Sec-WebSocket-Accept: qTyW61YJ7SPupUdzWc+W2X3pMgA= with no response body "GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:35 GMT Content-Type: application/problem+json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B2274797065223A2268747470733A2F2F746F6F6C732E696574662E6F72672F68746D6C2F726663393131302373656374696F6E2D31352E352E35222C227469....... "GET /api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:36 GMT Content-Type: application/problem+json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B2274797065223A2268747470733A2F2F746F6F6C732E696574662E6F72672F68746D6C2F726663393131302373656374696F6E2D31352E352E35222C227469....... "GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 204 No Content Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:36 GMT Connection: keep-alive with no response body "GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:41 GMT Content-Type: application/problem+json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B2274797065223A2268747470733A2F2F746F6F6C732E696574662E6F72672F68746D6C2F726663393131302373656374696F6E2D31352E352E35222C227469....... "GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 204 No Content Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:42 GMT Connection: keep-alive with no response body "GET /api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:47 GMT Content-Type: application/problem+json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B2274797065223A2268747470733A2F2F746F6F6C732E696574662E6F72672F68746D6C2F726663393131302373656374696F6E2D31352E352E35222C227469....... "GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:48 GMT Content-Type: application/problem+json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B2274797065223A2268747470733A2F2F746F6F6C732E696574662E6F72672F68746D6C2F726663393131302373656374696F6E2D31352E352E35222C227469....... "GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 204 No Content Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:47 GMT Connection: keep-alive with no response body "GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 204 No Content Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:52 GMT Connection: keep-alive with no response body "GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:53 GMT Content-Type: application/problem+json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B2274797065223A2268747470733A2F2F746F6F6C732E696574662E6F72672F68746D6C2F726663393131302373656374696F6E2D31352E352E35222C227469....... "GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 204 No Content Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:58 GMT Connection: keep-alive with no response body "GET /api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:58 GMT Content-Type: application/problem+json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B2274797065223A2268747470733A2F2F746F6F6C732E696574662E6F72672F68746D6C2F726663393131302373656374696F6E2D31352E352E35222C227469....... "GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:59 GMT Content-Type: application/problem+json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B2274797065223A2268747470733A2F2F746F6F6C732E696574662E6F72672F68746D6C2F726663393131302373656374696F6E2D31352E352E35222C227469....... "GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 204 No Content Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:24:03 GMT Connection: keep-alive with no response body "GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:24:04 GMT Content-Type: application/problem+json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B2274797065223A2268747470733A2F2F746F6F6C732E696574662E6F72672F68746D6C2F726663393131302373656374696F6E2D31352E352E35222C227469....... "GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 204 No Content Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:24:08 GMT Connection: keep-alive with no response body "GET /api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:24:08 GMT Content-Type: application/problem+json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B2274797065223A2268747470733A2F2F746F6F6C732E696574662E6F72672F68746D6C2F726663393131302373656374696F6E2D31352E352E35222C227469....... "GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:24:09 GMT Content-Type: application/problem+json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B2274797065223A2268747470733A2F2F746F6F6C732E696574662E6F72672F68746D6C2F726663393131302373656374696F6E2D31352E352E35222C227469.......34:T6e7,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "Process32NextW with parameter System" (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "Process32NextW with parameter Registry" (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00001144)35:Tf49,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")36:T1916,"POST /api/agents/heartbeat HTTP/1.1 Host: trustconnectsoftware.com Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8" with payload::==> "{"deviceId":"6fc3a3fd-b670-4c67-ab64-2c4737f0bf0b","deviceName":"CmGsLZS2JI9dgwK","name":"CmGsLZS2JI9dgwK","operatingSystem":"Microsoft Windows 10.0.22621","version":"6.1.0","installToken":"QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X","machineId":"EE7E1142-C5B8-06A3-E405-FB83596A6E20","ipAddress":"192.168.0.2","cpuModel":"Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz","totalRamMb":8192,"online":true}" HTTP/1.1 404 Not Found Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:25 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B226572726F72223A22446576696365206E6F7420666F756E64227D....... "POST /api/agents/register HTTP/1.1 Host: trustconnectsoftware.com Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8" with payload::==> "{"deviceId":"6fc3a3fd-b670-4c67-ab64-2c4737f0bf0b","deviceName":"CmGsLZS2JI9dgwK","name":"CmGsLZS2JI9dgwK","operatingSystem":"Microsoft Windows 10.0.22621","version":"6.1.0","installToken":"QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X","machineId":"EE7E1142-C5B8-06A3-E405-FB83596A6E20","ipAddress":"192.168.0.2","cpuModel":"Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz","totalRamMb":8192,"online":true}" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:25 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B226465766963654964223A2234383062663866332D376462642D343937662D383264642D373963616565366462363231227D....... "POST /api/agents/heartbeat HTTP/1.1 Host: trustconnectsoftware.com Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8" with payload::==> "{"deviceId":"480bf8f3-7dbd-497f-82dd-79caee6db621","deviceName":"CmGsLZS2JI9dgwK","name":"CmGsLZS2JI9dgwK","operatingSystem":"Microsoft Windows 10.0.22621","version":"6.1.0","installToken":"QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X","machineId":"EE7E1142-C5B8-06A3-E405-FB83596A6E20","ipAddress":"192.168.0.2","cpuModel":"Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz","totalRamMb":8192,"online":true}" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:25 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B22737461747573223A226F6B227D....... "POST /api/agents/heartbeat HTTP/1.1 Host: trustconnectsoftware.com Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8" with payload::==> "{"deviceId":"480bf8f3-7dbd-497f-82dd-79caee6db621","deviceName":"CmGsLZS2JI9dgwK","name":"CmGsLZS2JI9dgwK","operatingSystem":"Microsoft Windows 10.0.22621","version":"6.1.0","installToken":"QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X","machineId":"EE7E1142-C5B8-06A3-E405-FB83596A6E20","ipAddress":"192.168.0.2","cpuModel":"Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz","totalRamMb":8192,"online":true}" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:23:56 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B22737461747573223A226F6B227D....... "POST /api/agents/heartbeat HTTP/1.1 Host: trustconnectsoftware.com Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8" with payload::==> "{"deviceId":"480bf8f3-7dbd-497f-82dd-79caee6db621","deviceName":"CmGsLZS2JI9dgwK","name":"CmGsLZS2JI9dgwK","operatingSystem":"Microsoft Windows 10.0.22621","version":"6.1.0","installToken":"QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X","machineId":"EE7E1142-C5B8-06A3-E405-FB83596A6E20","ipAddress":"192.168.0.2","cpuModel":"Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz","totalRamMb":8192,"online":true}" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:24:27 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B22737461747573223A226F6B227D....... "POST /api/agents/heartbeat HTTP/1.1 Host: trustconnectsoftware.com Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8" with payload::==> "{"deviceId":"480bf8f3-7dbd-497f-82dd-79caee6db621","deviceName":"CmGsLZS2JI9dgwK","name":"CmGsLZS2JI9dgwK","operatingSystem":"Microsoft Windows 10.0.22621","version":"6.1.0","installToken":"QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X","machineId":"EE7E1142-C5B8-06A3-E405-FB83596A6E20","ipAddress":"192.168.0.2","cpuModel":"Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz","totalRamMb":8192,"online":true}" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:24:58 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B22737461747573223A226F6B227D....... "POST /api/agents/heartbeat HTTP/1.1 Host: trustconnectsoftware.com Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8" with payload::==> "{"deviceId":"480bf8f3-7dbd-497f-82dd-79caee6db621","deviceName":"CmGsLZS2JI9dgwK","name":"CmGsLZS2JI9dgwK","operatingSystem":"Microsoft Windows 10.0.22621","version":"6.1.0","installToken":"QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X","machineId":"EE7E1142-C5B8-06A3-E405-FB83596A6E20","ipAddress":"192.168.0.2","cpuModel":"Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz","totalRamMb":8192,"online":true}" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:25:28 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B22737461747573223A226F6B227D....... "POST /api/agents/heartbeat HTTP/1.1 Host: trustconnectsoftware.com Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8" with payload::==> "{"deviceId":"480bf8f3-7dbd-497f-82dd-79caee6db621","deviceName":"CmGsLZS2JI9dgwK","name":"CmGsLZS2JI9dgwK","operatingSystem":"Microsoft Windows 10.0.22621","version":"6.1.0","installToken":"QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X","machineId":"EE7E1142-C5B8-06A3-E405-FB83596A6E20","ipAddress":"192.168.0.2","cpuModel":"Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz","totalRamMb":8192,"online":true}" HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Fri 06 Feb 2026 19:25:59 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>7B22737461747573223A226F6B227D.......37:T98e,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\advapi32.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\kernel32.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\BCrypt.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\ntdll.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\ucrtbase.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\shcore.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\shell32.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\profapi.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\ole32.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\VCRUNTIME140_CLR0400.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\VCRUNTIME140_1_CLR0400.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\ucrtbase_clr0400.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\iphlpapi.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\winhttp.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\ws2_32.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\WINDOWS\system32\nlasvc.dll" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\WINDOWS\system32\nlasvc.dll.DLL" "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" trying to access non-existent file "C:\DEVOBJ.dll"38:T103b,Found registry query API: "RegOpenKeyExW" in file "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" Found registry query API: "RegGetValueW" in file "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" Found registry query API: "RegQueryValueExW" in file "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" Found registry query API: "g____PInvoke|10_0" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "g____PInvoke|11_0" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "g____PInvoke|13_0" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "g____PInvoke|6_0" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "g____PInvoke|7_0" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "g____PInvoke|9_0" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "RegEnumValue" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "RegQueryValueEx" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "RegEnumKeyEx" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "RegOpenKeyEx" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "RegQueryInfoKey" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "RegEnumKeyExWTU" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "RegEnumValueWTU" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "RegOpenKeyExWTU" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "RegQueryInfoKeyWTU" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp" Found registry query API: "RegQueryValueExWTU" in "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp"39:T662,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "ystem.Runtime.CompilerServices.IgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; Source: "00000000-00001144.00000000.119240.027D1000.00000020.mdmp, 00000000-00001144.00000000.119240.027F0000.00000004.mdmp") Found reference to API "EmitIgnoresAccessChecksToAttribute" (Indicator: "AccessCheck"; Source: "00000000-00001144.00000000.119240.027D1000.00000020.mdmp, 00000000-00001144.00000000.119240.027F0000.00000004.mdmp") Found reference to API "GetIgnoresAccessChecksToAttributeConstructor" (Indicator: "AccessCheck"; Source: "00000000-00001144.00000000.119240.027D1000.00000020.mdmp, 00000000-00001144.00000000.119240.027F0000.00000004.mdmp")3a:T13c5,Found string "vailable HTTP/1.1 connections:" (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "ending HTTP/1.1 connections:" (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "Total associated HTTP/1.1 connections:" (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "ax HTTP/1.1 connection limit:" (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "o available HTTP/1.1 connections; request queued." (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "ound expired HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "ound invalid HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "ound usable HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "isposing HTTP/1.1 connection return to pool. Connection lifetime expired." (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "equeued waiting HTTP/1.1 request." (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "iscarding signaled HTTP/1.1 request waiter from queue." (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "iscarding canceled HTTP/1.1 request from queue." (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "ut HTTP/1.1 connection in pool." (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "isposing HTTP/1.1 connection returned to pool. Pool was disposed." (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "reating new HTTP/1.1 connection for pool." (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "erver does not support HTTP2; disabling HTTP2 use and proceeding with HTTP/1.1 connection" (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "owngrading queued HTTP2 request to HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "iscarding downgraded HTTP/1.1 connection because HTTP/1.1 connection limit is exceeded" (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "*The HTTP/1.1 response chunk was too large." (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "The synchronous method is not supported by '{0}' for HTTP/2 or higher. Either use an asynchronous method or downgrade the request version to HTTP/1.1 or lower." (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found string "Failed to establish web socket connection over HTTP/2 because extended CONNECT is not supported. Try to downgrade the request version to HTTP/1.1." (Indicator: "HTTP/1.1"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp")3b:T4b3,Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "Failed to map file. GetFileSizeEx(%s) failed with error %d" (Indicator: "GetFileSize"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001144.00000000.119240.02400000.00000004.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp")3c:T7f9,Found reference to API "g____PInvoke|14_0" (Indicator: "RegSetValue"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API "g____PInvoke|15_0" (Indicator: "RegSetValue"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API "g____PInvoke|16_0" (Indicator: "RegSetValue"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API "g____PInvoke|17_0" (Indicator: "RegSetValue"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API "g____PInvoke|18_0" (Indicator: "RegSetValue"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API "g____PInvoke|8_0" (Indicator: "RegFlushKey"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API "RegSetValueEx" (Indicator: "RegSetValue"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API "RegSetValueExWTU" (Indicator: "RegSetValue"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp")3d:T5fe,Found string "ublicKey.Key is obsolete. Use the appropriate method to get the public key, such as GetRSAPublicKey." (Indicator: "public key"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found string "509Certificate2.PrivateKey is obsolete. Use the appropriate method to get the private key, such as GetRSAPrivateKey, or use the CopyWithPrivateKey method to create a new instance with a private key." (Indicator: "private key"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") file/memory contains long string with (Indicator: "private key"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") file/memory contains long string with (Indicator: "public key"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found string "kipping current X509Certificate2 {0} since it doesn't have private key. Certificate Subject: {1}, Thumbprint: {2}." (Indicator: "private key"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp")3e:Tfcb,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "VALIDATERESPONSENAMES"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "")3f:T2685,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8dda40000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8dda40000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8dda40000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "KERNEL32" at base 7ff8de8b0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff8b1c20000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "KERNEL32.DLL" at base 7ff8de8b0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "NTDLL" at base 7ff8e0550000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "KERNELBASE.DLL" at base 7ff8dda40000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8dffb0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff8dc9c0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\ADVAPI32.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "ADVAPI32.DLL" at base 7ff8de360000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\KERNEL32.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\BCRYPT.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "BCRYPT.DLL" at base 7ff8dd250000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff8de210000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\NTDLL.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "NTDLL.DLL" at base 7ff8e0550000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\UCRTBASE.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "UCRTBASE.DLL" at base 7ff8dddf0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "ICU.DLL" at base 7ff8b9840000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "RPCRT4.DLL" at base 7ff8de4b0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\SHCORE.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "SHCORE.DLL" at base 7ff8dfae0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\SHELL32.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "SHELL32.DLL" at base 7ff8df140000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\OLE32.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "OLE32.DLL" at base 7ff8df940000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\WMINET_UTILS.DLL" at base 7ff8c7aa0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff8dda40000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff8cfe70000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8d15f0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff8d0060000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff8dda40000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff8dda40000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff8d05f0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "AMSI.DLL" at base 7ff8cfcf0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff8d2220000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ff8cfc40000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\PEKAU4EP.DLL" at base 7ff8ac960000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff8dda40000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff8dda40000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff8dda40000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\IPHLPAPI.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "IPHLPAPI.DLL" at base 7ff8dc4e0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\WINHTTP.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "WINHTTP.DLL" at base 7ff8d7330000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff8bf340000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\WS2_32.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "WS2_32.DLL" at base 7ff8df0b0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff8dce30000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\WSHUNIX.DLL" at base 7ff8c8db0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\NLANSP_C.DLL" at base 7ff8c6a50000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\WSHBTH.DLL" at base 7ff8c4240000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ff8c8ba0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff8d5520000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ff8c84a0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ff8c80f0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff8d6360000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\SSPICLI.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "SSPICLI.DLL" at base 7ff8dcc10000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff8dc830000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff8cc9a0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\CRYPT32.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "CRYPT32.DLL" at base 7ff8ddf80000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\USER32.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "USER32.DLL" at base 7ff8dee50000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff8dc930000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8dafa0000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\GDIPLUS.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "GDIPLUS.DLL" at base 7ff8b3d70000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_57FA636ACE18905C\GDIPLUS.DLL" at base 7ff8b3d70000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "C:\GDI32.DLL" at base 0 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "GDI32.DLL" at base 7ff8e0450000 "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" loaded module "WINDOWSCODECS.DLL" at base 7ff8d980000040:T8aa,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp")41:T928,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\advapi32.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\kernel32.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\BCrypt.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\ntdll.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\ucrtbase.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\shcore.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\shell32.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\ole32.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\iphlpapi.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\winhttp.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\ws2_32.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\sspicli.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\crypt32.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\user32.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\gdiplus.dll" - [base:0; Status:c0000135] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" failed to load missing module "C:\gdi32.dll" - [base:0; Status:c0000135]42:T862,YARA signature "INDICATOR_RMM_ConnectWise_ScreenConnect_CERT" matched file "ScreenConnect.ClientService.exe" as "Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory" (Author: ditekSHen) YARA signature "INDICATOR_RMM_ConnectWise_ScreenConnect" matched file "ScreenConnect.Windows.dll" as "Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory" (Author: ditekSHen) YARA signature "INDICATOR_RMM_ConnectWise_ScreenConnect" matched file "MSI5B8B.tmp" as "Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory" (Author: ditekSHen) YARA signature "INDICATOR_RMM_ConnectWise_ScreenConnect_CERT" matched file "ScreenConnect.WindowsClient.exe" as "Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory" (Author: ditekSHen) YARA signature "INDICATOR_RMM_ConnectWise_ScreenConnect" matched file "ScreenConnect.Core.dll" as "Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory" (Author: ditekSHen) YARA signature "INDICATOR_RMM_ConnectWise_ScreenConnect_CERT" matched file "ScreenConnect.WindowsFileManager.exe" as "Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory" (Author: ditekSHen) YARA signature "INDICATOR_RMM_ConnectWise_ScreenConnect_CERT" matched file "ScreenConnect.WindowsBackstageShell.exe" as "Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory" (Author: ditekSHen) YARA signature "INDICATOR_RMM_ConnectWise_ScreenConnect" matched file "285ae3.msi" as "Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory" (Author: ditekSHen) YARA signature "INDICATOR_RMM_ConnectWise_ScreenConnect" matched file "285adf.msi" as "Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory" (Author: ditekSHen) YARA signature "INDICATOR_RMM_ConnectWise_ScreenConnect_CERT" matched file "ScreenConnect.WindowsCredentialProvider.dll" as "Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory" (Author: ditekSHen)43:Tb01,"ScreenConnect.Windows.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "ScreenConnect.WindowsCredentialProvider.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 5 sections"- [targetUID: 00000000-00007964] "ScreenConnect.WindowsClient.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "ScreenConnect.Core.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "ScreenConnect.WindowsAuthenticationPackage.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- [targetUID: 00000000-00007964] "ScreenConnect.Client.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "Microsoft.Deployment.WindowsInstaller.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "ScreenConnect.ClientService.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- [targetUID: 00000000-00007964] "ScreenConnect.WindowsFileManager.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "ScreenConnect.ClientService.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "ScreenConnect.WindowsBackstageShell.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "Microsoft.Deployment.WindowsInstaller.Package.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "Microsoft.Deployment.Compression.Cab.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "Microsoft.Deployment.Compression.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "ScreenConnect.InstallerActions.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: 00000000-00007964] "MSI5B8B.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 InstallShield self-extracting archive 5 sections"- [targetUID: 00000000-00007964] "MSI7282.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00007964] "MSI71A5.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00007964]44:T968,Found string "get_OSVersion" (Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000001.121162.05471000.00000020.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp, 00000000-00001144.00000002.123083.01200000.00000004.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp, 00000000-00001144.00000002.123083.053C0000.00000004.mdmp, 00000000-00001144.00000002.123083.05610000.00000004.mdmp, 00000000-00001144.00000002.123083.05811000.00000020.mdmp, 00000000-00001144.00000002.123083.06080000.00000004.mdmp, 00000000-00001144.00000002.123083.06111000.00000020.mdmp, 00000000-00001144.00000002.123083.06C10000.00000004.mdmp, 00000000-00001144.00000002.123083.06D00000.00000004.mdmp, 00000000-00001144.00000002.123083.06D51000.00000020.mdmp") Found string "CheckMachineName" (Source: "00000000-00001144.00000000.119240.04951000.00000020.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.04890000.00000004.mdmp") Found string "etUserNameExW" (Source: "00000000-00001144.00000000.119240.04AE0000.00000004.mdmp") Found string "get_UserName" (Source: "00000000-00001144.00000000.119240.04F60000.00000004.mdmp, 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp, 00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05471000.00000020.mdmp, 00000000-00001144.00000001.121162.05CB1000.00000020.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp, 00000000-00001144.00000002.123083.053C0000.00000004.mdmp, 00000000-00001144.00000002.123083.05C70000.00000004.mdmp") Found string "set_UserName" (Source: "00000000-00001144.00000000.119240.04F60000.00000004.mdmp, 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp, 00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.05CB1000.00000020.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp, 00000000-00001144.00000002.123083.05C70000.00000004.mdmp")45:T651,Found string "WMI.ExecQuery(SELECT UUID FROM Win32_ComputerSystemProduct);" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00001144.00000000.119240.02010000.00000004.mdmp, 00000000-00001144.00000001.121162.02010000.00000004.mdmp, 00000000-00001144.00000002.123083.02105000.00000004.mdmp") Found string "WMI.ExecQuery(SELECT UUID FROM Win32_ComputerSystemProduct);" (Indicator: " Win32_ComputerSystemProduct"; Source: "00000000-00001144.00000000.119240.02010000.00000004.mdmp, 00000000-00001144.00000001.121162.02010000.00000004.mdmp, 00000000-00001144.00000002.123083.02105000.00000004.mdmp") Found string "SELECT UUID FROM Win32_ComputerSystemProduct" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00001144.00000000.119240.04AE0000.00000004.mdmp, 00000000-00001144.00000001.121162.04D91000.00000004.mdmp, 00000000-00001144.00000002.123083.04AE0000.00000004.mdmp, 00000000-00001144.00000002.123083.04E29000.00000004.mdmp") Found string "SELECT UUID FROM Win32_ComputerSystemProduct" (Indicator: " Win32_ComputerSystemProduct"; Source: "00000000-00001144.00000000.119240.04AE0000.00000004.mdmp, 00000000-00001144.00000001.121162.04D91000.00000004.mdmp, 00000000-00001144.00000002.123083.04AE0000.00000004.mdmp, 00000000-00001144.00000002.123083.04E29000.00000004.mdmp") Found string "instance of Win32_ComputerSystemProduct" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00001144.00000000.119240.04AE0000.00000004.mdmp") Found string "instance of Win32_ComputerSystemProduct" (Indicator: " Win32_ComputerSystemProduct"; Source: "00000000-00001144.00000000.119240.04AE0000.00000004.mdmp")46:T783,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS"; Key: ""; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS"; Key: ""; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32"; Key: ""; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCHANDLER32"; Key: ""; Value: "")47:Tdf9b,Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "EventWrite"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RegCloseKey"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RegGetValueW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "OpenThreadToken"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "DeregisterEventSource"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetSidSubAuthority"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RegisterEventSourceW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "EventRegister"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "ReportEventW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RevertToSelf"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetKernelObjectSecurity"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetThreadToken"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetSystemTime"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "ReadFile"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "MapViewOfFileEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "QueryInformationJobObject"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetThreadIdealProcessorEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetThreadPriority"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "VirtualUnlock"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetErrorMode"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "ExitProcess"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "OpenEventW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetXStateFeaturesMask"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "VirtualProtect"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "ActivateActCtx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "HeapDestroy"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "IsProcessInJob"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CopyContext"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "IsWow64Process"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RaiseException"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SleepEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "TlsAlloc"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "ConnectNamedPipe"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetProcessGroupAffinity"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetLastError"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "HeapAlloc"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "FindClose"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SignalObjectAndWait"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetThreadErrorMode"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateProcessW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetProcAddress"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "FlushProcessWriteBuffers"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "K32GetProcessMemoryInfo"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetTempPathW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateMemoryResourceNotification"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "ResetEvent"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateFileA"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateFileW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetThreadContext"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetTickCount64"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "HeapFree"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "InitializeContext"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetStdHandle"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "FindResourceW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateThread"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetLargePageMinimum"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "LocateXStateFeature"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SwitchToThread"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetEvent"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetEnabledXStateFeatures"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "VirtualQuery"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "TlsFree"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetActiveProcessorGroupCount"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CancelIoEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "FlushInstructionCache"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RtlUnwind"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "DecodePointer"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RtlAddFunctionTable"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SuspendThread"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CloseHandle"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetNumaHighestNodeNumber"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetStringTypeExW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "InterlockedPopEntrySList"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetThreadIdealProcessorEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "QueueUserAPC"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "FormatMessageW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "EncodePointer"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "DisconnectNamedPipe"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetFilePointer"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "LocalFree"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetFileSize"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "TlsGetValue"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetACP"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "TlsSetValue"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "WerRegisterRuntimeExceptionModule"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "QueryThreadCycleTime"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateActCtxW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "VirtualAllocExNuma"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateMutexW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetThreadGroupAffinity"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "HeapCreate"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetThreadAffinityMask"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "FreeLibrary"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetNumaProcessorNodeEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "WriteFile"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "DebugBreak"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetThreadGroupAffinity"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "ExitThread"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetLastError"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateNamedPipeA"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "FindNextFileW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateFileMappingA"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SetThreadContext"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateEventW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "ResumeThread"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "TerminateProcess"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "Sleep"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetCPInfo"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "VirtualFree"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetTickCount"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "VariantInit"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SysStringLen"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "VariantClear"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SafeArrayPutElement"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SysFreeString"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SysAllocString"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "VariantChangeType"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "MessageBoxW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "LoadStringW"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CoMarshalInterface"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CoCreateFreeThreadedMarshaler"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CoUninitialize"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CoReleaseMarshalData"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CoGetClassObject"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "CoCreateGuid"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05471000.00000020.mdmp, 00000000-00001144.00000001.121162.06331000.00000020.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp, 00000000-00001144.00000002.123083.053C0000.00000004.mdmp, 00000000-00001144.00000002.123083.06300000.00000004.mdmp, 00000000-00001144.00000002.123083.10AD8000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001144.00000000.119240.004D0000.00000004.mdmp, 00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.02870000.00000004.mdmp, 00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000000.119240.04F60000.00000004.mdmp, 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp, 00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.02570000.00000004.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp, 00000000-00001144.00000001.121162.05471000.00000020.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp, 00000000-00001144.00000001.121162.06031000.00000020.mdmp, 00000000-00001144.00000001.121162.06331000.00000020.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp, 00000000-00001144.00000002.123083.01200000.00000004.mdmp, 00000000-00001144.00000002.123083.024F1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp, 00000000-00001144.00000002.123083.053C0000.00000004.mdmp, 00000000-00001144.00000002.123083.05610000.00000004.mdmp, 00000000-00001144.00000002.123083.05811000.00000020.mdmp, 00000000-00001144.00000002.123083.06050000.00000004.mdmp, 00000000-00001144.00000002.123083.06080000.00000004.mdmp, 00000000-00001144.00000002.123083.06111000.00000020.mdmp, 00000000-00001144.00000002.123083.06300000.00000004.mdmp, 00000000-00001144.00000002.123083.06C10000.00000004.mdmp, 00000000-00001144.00000002.123083.06D00000.00000004.mdmp, 00000000-00001144.00000002.123083.06D51000.00000020.mdmp, 00000000-00001144.00000002.123083.10AD8000.00000002.mdmp") Found reference to API (Indicator: "GetExtendedTcpTable"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API (Indicator: "GetTcpTable"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API (Indicator: "GetExtendedUdpTable"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API (Indicator: "GetUdpTable"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp, 00000000-00001144.00000002.123083.06080000.00000004.mdmp, 00000000-00001144.00000002.123083.06111000.00000020.mdmp") Found reference to API (Indicator: "QueueUserWorkItem"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to API (Indicator: "GetPerAdapterInfo"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API (Indicator: "GetIcmpStatistics"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API (Indicator: "GetAdaptersAddresses"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API (Indicator: "GetNetworkParams"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.04F60000.00000004.mdmp, 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp") Found reference to API (Indicator: "GetBestInterfaceEx"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API (Indicator: "GetIpStatisticsEx"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API (Indicator: "GetTcpStatisticsEx"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API (Indicator: "GetUdpStatisticsEx"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API (Indicator: "GetIcmpStatisticsEx"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001144.00000000.119240.01301000.00000020.mdmp, 00000000-00001144.00000000.119240.02380000.00000004.mdmp, 00000000-00001144.00000000.119240.027D1000.00000020.mdmp, 00000000-00001144.00000000.119240.027F0000.00000004.mdmp, 00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.02250000.00000004.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp, 00000000-00001144.00000002.123083.06C10000.00000004.mdmp") Found reference to API (Indicator: "GetFileInfo"; Source: "00000000-00001144.00000000.119240.02380000.00000004.mdmp, 00000000-00001144.00000001.121162.00550000.00000004.mdmp, 00000000-00001144.00000001.121162.01320000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00001144.00000000.119240.02400000.00000004.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00001144.00000000.119240.02481000.00000020.mdmp, 00000000-00001144.00000000.119240.02870000.00000004.mdmp, 00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000001.121162.00550000.00000004.mdmp, 00000000-00001144.00000001.121162.02390000.00000004.mdmp, 00000000-00001144.00000001.121162.02410000.00000004.mdmp, 00000000-00001144.00000001.121162.06031000.00000020.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp, 00000000-00001144.00000002.123083.06050000.00000004.mdmp, 00000000-00001144.00000002.123083.06080000.00000004.mdmp, 00000000-00001144.00000002.123083.06111000.00000020.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00001144.00000000.119240.02541000.00000020.mdmp, 00000000-00001144.00000000.119240.04951000.00000020.mdmp, 00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000001.121162.02510000.00000004.mdmp, 00000000-00001144.00000001.121162.04890000.00000004.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00001144.00000000.119240.02541000.00000020.mdmp, 00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02510000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp, 00000000-00001144.00000002.123083.06C10000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001144.00000000.119240.02870000.00000004.mdmp, 00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00001144.00000000.119240.02870000.00000004.mdmp, 00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001144.00000000.119240.02870000.00000004.mdmp, 00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleCP"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleOutputCP"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleTitleW"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "FillConsoleOutputCharacterW"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleInputW"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "PeekConsoleInputW"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleOutputW"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleOutputW"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfoExW"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp, 00000000-00001144.00000002.123083.10AD8000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp, 00000000-00001144.00000002.123083.10AD8000.00000002.mdmp") Found reference to API (Indicator: "ReadConsole"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "WriteConsole"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "FillConsoleOutputAttribute"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleTextAttribute"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp, 00000000-00001144.00000002.123083.10AD8000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "GetLargestConsoleWindowSize"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCursorInfo"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleCursorInfo"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleWindowInfo"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp, 00000000-00001144.00000002.123083.10AD8000.00000002.mdmp") Found reference to API (Indicator: "CreateEvent"; Source: "00000000-00001144.00000000.119240.04951000.00000020.mdmp, 00000000-00001144.00000001.121162.04890000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00001144.00000000.119240.04AE0000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteTreeW"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp, 00000000-00001144.00000002.123083.05610000.00000004.mdmp, 00000000-00001144.00000002.123083.05811000.00000020.mdmp, 00000000-00001144.00000002.123083.10AD8000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteTree"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "FormatMessage"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp, 00000000-00001144.00000002.123083.05610000.00000004.mdmp, 00000000-00001144.00000002.123083.05811000.00000020.mdmp") Found reference to API (Indicator: "GetMessage"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp, 00000000-00001144.00000002.123083.05610000.00000004.mdmp, 00000000-00001144.00000002.123083.05811000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteValue"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValue"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueEx"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueEx"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyEx"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyEx"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyEx"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyEx"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegQueryInfoKey"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp") Found reference to API (Indicator: "RegConnectRegistry"; Source: "00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp")48:T537,Found string "password" (Indicator: "password"; Source: "00000000-00001144.00000000.119240.04951000.00000020.mdmp, 00000000-00001144.00000001.121162.028C0000.00000004.mdmp, 00000000-00001144.00000001.121162.04731000.00000020.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.04890000.00000004.mdmp, 00000000-00001144.00000001.121162.05471000.00000020.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp, 00000000-00001144.00000002.123083.053C0000.00000004.mdmp") Found string "_passwordChar" (Indicator: "password"; Source: "00000000-00001144.00000000.119240.04951000.00000020.mdmp, 00000000-00001144.00000001.121162.04890000.00000004.mdmp") Found string "_password" (Indicator: "password"; Source: "00000000-00001144.00000000.119240.04F60000.00000004.mdmp, 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp, 00000000-00001144.00000001.121162.05CB1000.00000020.mdmp, 00000000-00001144.00000002.123083.05610000.00000004.mdmp, 00000000-00001144.00000002.123083.05811000.00000020.mdmp, 00000000-00001144.00000002.123083.05C70000.00000004.mdmp") Found string ":SOCKS server requested username & password authentication." (Indicator: "password"; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp")49:T894,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" queried SystemProcessInformation at 00000000-00001144-00000C15-791558452 [PID: 1144] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" queried SystemProcessInformation at 00000000-00001144-00000C15-791578025 [PID: 1144] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" queried SystemProcessInformation at 00000000-00001144-00000C15-792865164 [PID: 1144] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" queried SystemProcessInformation at 00000000-00001144-00000C15-792873177 [PID: 1144] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" queried SystemProcessInformation at 00000000-00001144-00000C15-793522875 [PID: 1144] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" queried SystemProcessInformation at 00000000-00001144-00000C15-793530777 [PID: 1144] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" queried SystemProcessInformation at 00000000-00001144-00000C15-793594633 [PID: 1144] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" queried SystemProcessInformation at 00000000-00001144-00000C15-793603410 [PID: 1144] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" queried SystemProcessInformation at 00000000-00001144-00000C15-795935507 [PID: 1144] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" queried SystemProcessInformation at 00000000-00001144-00000C15-795949805 [PID: 1144] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" queried SystemProcessInformation at 00000000-00001144-00000C15-797347403 [PID: 1144] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" queried SystemProcessInformation at 00000000-00001144-00000C15-797355055 [PID: 1144] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" queried SystemProcessInformation at 00000000-00001144-00000C15-800660339 [PID: 1144] "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" queried SystemProcessInformation at 00000000-00001144-00000C15-800670641 [PID: 1144]4a:T80e,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001144)4b:Te66,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001144-00000C2C-797899036") Found reference to API "EConstructor marked with {0} does not accept all given argument types." (Indicator: " accept "; Source: "00000000-00001144.00000000.119240.00420000.00000004.mdmp") Found reference to API "se the Graphics.GetContextInfo overloads that accept arguments for better performance and fewer allocations." (Indicator: " accept "; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found reference to API "GetHostName" (Indicator: "gethostname"; Source: "00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp, 00000000-00001144.00000001.121162.06031000.00000020.mdmp, 00000000-00001144.00000002.123083.06050000.00000004.mdmp") file/memory contains long string with (Indicator: " bind "; Source: "00000000-00001144.00000000.119240.023F0000.00000004.mdmp") file/memory contains long string with (Indicator: " bind "; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found reference to API "pThe extension data property '{0}' on type '{1}' cannot bind with a parameter in the deserialization constructor." (Indicator: " bind "; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found reference to API "oMembers '{0}' and '{1}' on type '{2}' cannot both bind with parameter '{3}' in the deserialization constructor." (Indicator: " bind "; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found reference to API "&Unable to connect to the remote server" (Indicator: " connect "; Source: "00000000-00001144.00000000.119240.04870000.00000004.mdmp, 00000000-00001144.00000001.121162.04851000.00000020.mdmp") Found reference to API "ailed to send request body:" (Indicator: " send "; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found reference to API "aiting to send request body content for 100-Continue." (Indicator: " send "; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found reference to API "ZThe request message was already sent. Cannot send the same request message multiple times." (Indicator: " send "; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found reference to API "2SOCKS server failed to connect to the destination." (Indicator: " connect "; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found reference to API "Failed to establish web socket connection over HTTP/2 because extended CONNECT is not supported. Try to downgrade the request version to HTTP/1.1." (Indicator: " socket "; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp") Found reference to API "Failed to establish web socket connection over HTTP/2 because extended CONNECT is not supported. Try to downgrade the request version to HTTP/1.1." (Indicator: " connect "; Source: "00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp")4c:T413,Process 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1144:120:WilError_03" Process 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe created mutex with name "Local\SM0:1144:304:WilStaging_02" Process 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe created mutex with name "SM0:1144:120:WilError_03" Process 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe created mutex with name "Local\SM0:1144:120:WilError_03" Process 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe created mutex with name "\BaseNamedObjects\TrustConnectAgent_QBt4muaH" Process 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1144:120:WilError_03" Process 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1144:304:WilStaging_02"4d:T954,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "ScreenConnect.WindowsFileManager.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "ScreenConnect.WindowsFileManager.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "ScreenConnect.WindowsFileManager.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "ScreenConnect.WindowsFileManager.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "ScreenConnect.WindowsFileManager.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "ScreenConnect.WindowsFileManager.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "ScreenConnect.ClientService.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "ScreenConnect.ClientService.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteByte" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "Microsoft.Deployment.Compression.Cab.dll" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Microsoft.Deployment.Compression.dll"4e:T9b0,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe "SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe "SOFTWARE\Classes\" in Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe "HKCU\" in Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe "HKLM\" in Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe "SOFTWARE\dotnet" in Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe "\Software\Classes\AppID\8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW64" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp4f:Tdd4c,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter InitializeContext2 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter QueueUserAPC2 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter VirtualAlloc2 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter MapViewOfFile3 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumberEx (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ReadDirectoryChangesW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetSystemTimes (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter u_charsToUChars (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter u_getVersion (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter u_strcmp (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter u_strcpy (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter u_strlen (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter u_strncpy (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter u_tolower (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter u_toupper (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter u_uastrncpy (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ubrk_close (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ubrk_openRules (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucal_add (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucal_close (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucal_get (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucal_getAttribute (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucal_getKeywordValuesForLocale (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucal_getLimit (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucal_getNow (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucal_getTimeZoneDisplayName (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucal_open (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucal_openTimeZoneIDEnumeration (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucal_set (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucal_setMillis (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_close (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_closeElements (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_getOffset (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_getRules (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_getSortKey (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_getStrength (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_getVersion (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_next (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_previous (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_open (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_openElements (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_openRules (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_setAttribute (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_strcoll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter udat_close (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter udat_countSymbols (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter udat_format (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter udat_getSymbols (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter udat_open (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter udat_setCalendar (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter udat_toPattern (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter udatpg_close (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter udatpg_getBestPattern (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter udatpg_open (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uenum_close (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uenum_count (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uenum_next (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uidna_close (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uidna_nameToASCII (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uidna_nameToUnicode (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uidna_openUTS46 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_canonicalize (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_countAvailable (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getAvailable (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getBaseName (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getCharacterOrientation (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getCountry (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getDefault (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getDisplayCountry (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getDisplayLanguage (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getDisplayName (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getISO3Country (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getISO3Language (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getKeywordValue (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getLanguage (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getLCID (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getName (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_getParent (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uloc_setKeywordValue (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ulocdata_getCLDRVersion (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ulocdata_getMeasurementSystem (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter unorm2_getNFCInstance (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter unorm2_getNFDInstance (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter unorm2_getNFKCInstance (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter unorm2_getNFKDInstance (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter unorm2_isNormalized (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter unorm2_normalize (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter unum_close (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter unum_getAttribute (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter unum_getSymbol (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter unum_open (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter unum_toPattern (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ures_close (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ures_getByKey (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ures_getSize (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ures_getStringByIndex (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ures_open (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter usearch_close (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter usearch_first (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter usearch_getBreakIterator (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter usearch_getMatchedLength (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter usearch_last (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter usearch_openFromCollator (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter usearch_setPattern (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter usearch_setText (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucal_getWindowsTimeZoneID (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucal_getTimeZoneIDForWindowsID (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_setMaxVariable (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_clone (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucurr_forLocale (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucurr_getName (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uldn_close (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uldn_keyValueDisplayName (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter uldn_open (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ucol_safeClone (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter K32EnumProcesses (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatus (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SetProcessDpiAwareness (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CreateMutexExW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetPerAdapterInfo (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetAddrInfoExCancel (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter FreeAddrInfoExW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter getsockopt (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter RevertToSelf (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter BCryptHash (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GdipGetImageGraphicsContext (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter GetThreadIOPendingFlag (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00001144)50:Tb29,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")51:T1c01,Found string "EnableAES" (Indicator: "aes"; File: "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe") Found string "he Rijndael and RijndaelManaged types are obsolete. Use Aes instead." (Indicator: "aes"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found string "he Rijndael and RijndaelManaged types are obsolete. Use Aes instead." (Indicator: "rijndael"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found string "he Rijndael and RijndaelManaged types are obsolete. Use Aes instead." (Indicator: "Rijndaelmanaged"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found string "SA.EncryptValue and DecryptValue are not supported and throw NotSupportedException. Use RSA.Encrypt and RSA.Decrypt instead." (Indicator: ".decrypt"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found string "SA.EncryptValue and DecryptValue are not supported and throw NotSupportedException. Use RSA.Encrypt and RSA.Decrypt instead." (Indicator: ".encrypt"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found string "RijndaelDiagId" (Indicator: "rijndael"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found string "RNGCryptoServiceProviderDiagId" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found string "AesGcmTagConstructorDiagId" (Indicator: "aes"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found string "RijndaelMessage" (Indicator: "rijndael"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found string "RNGCryptoServiceProviderMessage" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found string "AesGcmTagConstructorMessage" (Indicator: "aes"; Source: "00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.023F0000.00000004.mdmp, 00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000001.121162.00430000.00000004.mdmp, 00000000-00001144.00000001.121162.05471000.00000020.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp, 00000000-00001144.00000002.123083.053C0000.00000004.mdmp, 00000000-00001144.00000002.123083.05610000.00000004.mdmp, 00000000-00001144.00000002.123083.05811000.00000020.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00001144.00000000.119240.023F0000.00000004.mdmp, 00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000001.121162.00430000.00000004.mdmp, 00000000-00001144.00000001.121162.05471000.00000020.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp, 00000000-00001144.00000002.123083.053C0000.00000004.mdmp, 00000000-00001144.00000002.123083.05610000.00000004.mdmp, 00000000-00001144.00000002.123083.05811000.00000020.mdmp") Found string "Base64" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02541000.00000020.mdmp, 00000000-00001144.00000001.121162.02510000.00000004.mdmp, 00000000-00001144.00000002.123083.00450000.00000004.mdmp") Found string "annotDecodeInvalidBase64N" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found string "annotDecodeInvalidBase64" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found string "ECannot decode JSON text that is not encoded as valid Base64 to bytes." (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found string "get_CannotDecodeInvalidBase64" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found string "TryDecodeBase64" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found string "TryGetBytesFromBase64" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found string "WriteBase64Indented" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found string "WriteBase64Minimized" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found string "TryDecodeBase64InPlace" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found string "WriteBase64Escape" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found string "Base64EncodeAndWrite" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found string "WriteBase64StringValue" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found string "WriteBase64String" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp") Found string "TryGetUnescapedBase64Bytes" (Indicator: "base64"; Source: "00000000-00001144.00000000.119240.02940000.00000004.mdmp, 00000000-00001144.00000001.121162.02AB1000.00000020.mdmp")52:T1b78,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter kernelbase.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\advapi32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\kernel32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\BCrypt.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter BCrypt.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\ntdll.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\ucrtbase.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter ucrtbase.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter icu.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\shcore.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter shcore.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\shell32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\ole32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\wminet_utils.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\iphlpapi.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\winhttp.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\ws2_32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\sspicli.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter sspicli.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\crypt32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\user32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\gdiplus.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter C:\gdi32.dll (UID: 00000000-00001144) "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001144)53:Tda3,"\Software\Classes\AppID\8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0000032A-0000-0000-C000-000000000046}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW64" in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp "KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog" in Source: 00000000-00001144.00000001.121162.047E0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled" in Source: 00000000-00001144.00000001.121162.04D91000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00001144.00000001.121162.10900000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList" in Source: 00000000-00001144.00000001.121162.10900000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00001144.00000001.121162.10900000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications" in Source: 00000000-00001144.00000001.121162.10900000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00001144.00000001.121162.10900000.00000002.mdmp "HKCU\" in Source: 00000000-00001144.00000001.121162.10900000.00000002.mdmp "HKLM\" in Source: 00000000-00001144.00000001.121162.10900000.00000002.mdmp "SOFTWARE\dotnet" in Source: 00000000-00001144.00000001.121162.10900000.00000002.mdmp "SSLKEYLOGFILE=C:\Users\HAPUBWS\AppData\Local\Temp\ssl\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}USER$" in Source: 00000000-00001144.00000002.123083.063D0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}H" in Source: 00000000-00001144.00000002.123083.063D0000.00000004.mdmp54:T678,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001144.00000000.119240.02010000.00000004.mdmp, 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp, 00000000-00001144.00000000.119240.0B5D0000.00000004.mdmp, 00000000-00001144.00000000.119240.0B850000.00000004.mdmp, 00000000-00001144.00000001.121162.02010000.00000004.mdmp, 00000000-00001144.00000001.121162.0B5D0000.00000004.mdmp, 00000000-00001144.00000001.121162.0B850000.00000004.mdmp, 00000000-00001144.00000002.123083.02010000.00000004.mdmp, 00000000-00001144.00000002.123083.0B5D0000.00000004.mdmp, 00000000-00001144.00000002.123083.0B850000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001144.00000000.119240.02010000.00000004.mdmp, 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp, 00000000-00001144.00000000.119240.0B5D0000.00000004.mdmp, 00000000-00001144.00000000.119240.0B850000.00000004.mdmp, 00000000-00001144.00000001.121162.02010000.00000004.mdmp, 00000000-00001144.00000001.121162.0B5D0000.00000004.mdmp, 00000000-00001144.00000001.121162.0B850000.00000004.mdmp, 00000000-00001144.00000002.123083.02010000.00000004.mdmp, 00000000-00001144.00000002.123083.0B5D0000.00000004.mdmp, 00000000-00001144.00000002.123083.0B850000.00000004.mdmp") Found string "ows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001144.00000000.119240.04AE0000.00000004.mdmp") Found string "ows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001144.00000000.119240.04AE0000.00000004.mdmp")55:Ta22,"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: ""; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTRATIONENABLED"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "REGISTERADAPTERNAME"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "ENABLEMULTICAST"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "QUERYADAPTERNAME"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "DOMAIN"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "SEARCHLIST"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "NAMESERVER"; Value: "") "8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E122B924-B4ED-4437-BC94-A96B6AA901B6}"; Key: "PROFILENAMESERVER"; Value: "")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["new_domain","evasive","malicious"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"ScreenConnect.Windows.dll","sha256":"602a640e2d9f94acfe47d3946f7dd088992431e24b670d40233e1ae6e9e270ad","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ScreenConnect.Client.dll","sha256":"33f8abd5722ab19aeacfe24319cda4433b0bf9b482dad4865685975c11c15534","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ScreenConnect.ClientService.exe","sha256":"4fe150116089d55c48748a97985f1d18054db5758020b193ad31d63e849b57f6","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ScreenConnect.WindowsFileManager.exe","sha256":"41d9790fa15264d6bb65ef678f6418526e8137ce96bb42e65c6f3a03a8edc360","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Microsoft.Deployment.WindowsInstaller.Package.dll","sha256":"548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"285ae3.msi","sha256":"5a6926cee3aacd452d7b3960e5e932ffee95a86ad7e41a46449775e3b9fbcc4f","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"rundll32.exe.log","sha256":"de75fd7bd1a073d76b574407e6c4b7b58a2924bd341eb33fca4e167897c8a8c2","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ScreenConnect.WindowsCredentialProvider.dll","sha256":"36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ScreenConnect.Core.dll","sha256":"51d9dcd755a424b8b3122350bbcc02d453880c39636fb1e0265084161afca983","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Microsoft.Deployment.WindowsInstaller.dll","sha256":"3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ScreenConnect.WindowsBackstageShell.exe","sha256":"46589e65a4e87dd3ab967e17238bb1102d74e5cf52078b43ca795a67c75ed6d6","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Microsoft.Deployment.Compression.Cab.dll","sha256":"9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ScreenConnect.InstallerActions.dll","sha256":"8f4a00b34720f19b0e67dc957085ad1986e58bb16a1abcc580dab21bcd61382d","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ScreenConnect.WindowsAuthenticationPackage.dll","sha256":"a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ScreenConnect.WindowsBackstageShell.exe.config","sha256":"87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"device.id","sha256":"9723c38d95aaa275df38c2b23e6556a5a658cf43644b09e3de54c5b7c1186ec6","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"285adf.msi","sha256":"5a6926cee3aacd452d7b3960e5e932ffee95a86ad7e41a46449775e3b9fbcc4f","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ScreenConnect.WindowsClient.exe","sha256":"465e9cee277db463677b2b593809e794279d64314b4fa736aa93780a0f7e3975","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"ScreenConnect.ClientService.dll","sha256":"554ba93c3c34fc5cf6cb49ac7285069e853aa5543219e012bf0e9ca4400c3255","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Microsoft.Deployment.Compression.dll","sha256":"e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"},{"name":"config.json","sha256":"533f87cea4a45aa80dbeb073053fa5770ea94c225cb0b8b05f89bbc5722c040e","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,System.Diagnostics.EventLog","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,System.CodeDom,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration.Json,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging.Configuration","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging.Debug","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration.FileExtensions","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static,8.0.22","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration.Binder,8.0.0","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration.Abstractions","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.DependencyInjection,8.0.0","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging,8.0.0","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging.Console","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Hosting.WindowsServices","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging.EventLog,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"C:\\temp\\0_after_registration.txt","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Diagnostics","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Options,8.0.0","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration.Json","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration.UserSecrets","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,System.ServiceProcess.ServiceController,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration.CommandLine,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\TrustConnect\\QBt4muaH\\config.json","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging.EventSource","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Win32.SystemEvents,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"C:\\temp\\1_stream_called.txt","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\TrustConnect\\QBt4muaH\\device.id","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration.Binder","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.FileSystemGlobbing","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Primitives","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"C:\\TEMP\\0_AFTER_REGISTRATION.TXT","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging.Configuration,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.FileSystemGlobbing,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration.Abstractions,8.0.0","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Diagnostics.Abstractions","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,System.Management,8.0.0","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Hosting.WindowsServices,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration.CommandLine","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.DependencyInjection.Abstractions,8.0.0","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Hosting","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Win32.SystemEvents","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Hosting.Abstractions,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration,8.0.0","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.FileProviders.Abstractions,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,System.Drawing.Common,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration.UserSecrets,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,System.Management","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Hosting,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,System.CodeDom","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"C:\\temp\\2_taskrun_started.txt","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.FileProviders.Physical","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration.EnvironmentVariables","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Diagnostics.Abstractions,8.0.0","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"C:\\temp\\3_ws_connecting.txt","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration.EnvironmentVariables,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.DependencyInjection.Abstractions","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"C:\\TEMP\\2_TASKRUN_STARTED.TXT","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,System.Diagnostics.EventLog,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,System.Drawing.Common","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging.EventLog","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.FileProviders.Abstractions","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging.Debug,8.0.0","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Options.ConfigurationExtensions,8.0.0","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,System.ServiceProcess.ServiceController","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Hosting.Abstractions","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Primitives,8.0.0","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Options.ConfigurationExtensions","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"C:\\TEMP\\3_WS_CONNECTING.TXT","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration.FileExtensions,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging.EventSource,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Options","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"C:\\TEMP\\0_BEFORE_STARTSCREEN.TXT","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging.Console,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"C:\\temp\\0_before_startscreen.txt","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.FileProviders.Physical,8.0.0","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging.Abstractions","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Logging.Abstractions,8.0.0","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.DependencyInjection","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Diagnostics,8.0.0","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Microsoft.Extensions.Configuration","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"path":"C:\\TEMP\\1_STREAM_CALLED.TXT","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:1144:120:WilError_03","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1144:120:WilError_03","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1144:304:WilStaging_02","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"name":"Local\\SM0:7964:304:WilStaging_02","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\TrustConnectAgent_QBt4muaH","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1144:120:WilError_03","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"name":"Local\\SM0:1144:304:WilStaging_02","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"name":"SM0:1144:120:WilError_03","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7964:304:WilStaging_02","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"178.128.69.245","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]}],"dns_resolutions":[{"address":"178.128.69.245","country":"United States","domain":"trustconnectsoftware.com","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]}],"http_requests":[{"header":"POST /api/agents/register HTTP/1.1\nHost: trustconnectsoftware.com\nTransfer-Encoding: chunked\nContent-Type: application/json; charset=utf-8","host":"trustconnectsoftware.com","host_ip":"178.128.69.245:443","method":"POST","response_code":"200","response_phrase":"OK","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"url":"/api/agents/register"},{"header":"GET /agent-update?version=6.1.0&token=QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X HTTP/1.1","host":"trustconnectsoftware.com","host_ip":"178.128.69.245:443","method":"GET","response_code":"204","response_phrase":"No Content","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"url":"/agent-update?version=6.1.0&token=QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X"},{"header":"GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1","host":"trustconnectsoftware.com","host_ip":"178.128.69.245:443","method":"GET","response_code":"404","response_phrase":"Not Found","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}],"url":"/api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621"},{"header":"GET /ws/screen?deviceId=0842af96-9323-491b-92be-0fa768ff8f3a HTTP/1.1\nHost: trustconnectsoftware.com\nConnection: Upgrade\nUpgrade: websocket\nSec-WebSocket-Key: KCpVbjXgOEmpJlDeTV/6qA==\nSec-WebSocket-Version: 13","host":"trustconnectsoftware.com","host_ip":"178.128.69.245:443","method":"GET","response_code":"101","response_phrase":"Switching Protocols","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"url":"/ws/screen?deviceId=0842af96-9323-491b-92be-0fa768ff8f3a"},{"header":"GET /api/files/pull?deviceId=0842af96-9323-491b-92be-0fa768ff8f3a HTTP/1.1","host":"trustconnectsoftware.com","host_ip":"178.128.69.245:443","method":"GET","response_code":"404","response_phrase":"Not Found","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"url":"/api/files/pull?deviceId=0842af96-9323-491b-92be-0fa768ff8f3a"},{"header":"GET /api/files/browse/pull?deviceId=0842af96-9323-491b-92be-0fa768ff8f3a HTTP/1.1","host":"trustconnectsoftware.com","host_ip":"178.128.69.245:443","method":"GET","response_code":"404","response_phrase":"Not Found","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"url":"/api/files/browse/pull?deviceId=0842af96-9323-491b-92be-0fa768ff8f3a"},{"header":"GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1","host":"trustconnectsoftware.com","host_ip":"178.128.69.245:443","method":"GET","response_code":"204","response_phrase":"No Content","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}],"url":"/api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621"},{"header":"GET /api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1","host":"trustconnectsoftware.com","host_ip":"178.128.69.245:443","method":"GET","response_code":"404","response_phrase":"Not Found","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}],"url":"/api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621"},{"header":"GET /ws/screen?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1\nHost: trustconnectsoftware.com\nConnection: Upgrade\nUpgrade: websocket\nSec-WebSocket-Key: 2fQg5/YB/UqJfOPSDFsglA==\nSec-WebSocket-Version: 13","host":"trustconnectsoftware.com","host_ip":"178.128.69.245:443","method":"GET","response_code":"101","response_phrase":"Switching Protocols","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}],"url":"/ws/screen?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621"},{"header":"POST /api/agents/heartbeat HTTP/1.1\nHost: trustconnectsoftware.com\nTransfer-Encoding: chunked\nContent-Type: application/json; charset=utf-8","host":"trustconnectsoftware.com","host_ip":"178.128.69.245:443","method":"POST","response_code":"404","response_phrase":"Not Found","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"url":"/api/agents/heartbeat"},{"header":"GET /api/agent-commands/0842af96-9323-491b-92be-0fa768ff8f3a HTTP/1.1","host":"trustconnectsoftware.com","host_ip":"178.128.69.245:443","method":"GET","response_code":"204","response_phrase":"No Content","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"url":"/api/agent-commands/0842af96-9323-491b-92be-0fa768ff8f3a"}]},"process_activity":{"all_imported_dlls":["shlwapi.dll","wshbth.dll","VxSSL64.dll","msasn1.dll","win32u.dll","cryptsp.dll","version.dll","BCP47Langs.dll","powrprof.dll","pnrpnsp.dll","ntasn1.dll","wbemsvc.dll","msvcrt.dll","cryptbase.dll","ncryptsslp.dll","windows.storage.dll","FWPUCLNT.DLL","dhcpcsvc6.dll","wbemcomn.dll","gdi32full.dll","rasadhlp.dll","wshunix.dll","mswsock.dll","bcryptprimitives.dll","clbcatq.dll","imm32.dll","combase.dll","GdiPlus.dll","PEKaU4Ep.dll","icuuc.dll","ucrtbase_clr0400.dll","WMINet_Utils.dll","ws2_32.dll","vcruntime140_1_clr0400.dll","rsaenh.dll","profapi.dll","ncrypt.dll","msctf.dll","crypt32.dll","NapiNSP.dll","ucrtbase.dll","OnDemandConnRouteHelper.dll","advapi32.dll","devobj.dll","ole32.dll","kernel.appcore.dll","KernelBase.dll","amsi.dll","userenv.dll","winrnr.dll","gpapi.dll","nlaapi.dll","icu.dll","msvcp_win.dll","vcruntime140_clr0400.dll","wmiutils.dll","shell32.dll","gdi32.dll","WinTypes.dll","xmllite.dll","dhcpcsvc.dll","cfgmgr32.dll","schannel.dll","nlansp_c.dll","bcrypt.dll","user32.dll","icuin.dll","sechost.dll","winnsi.dll","IPHLPAPI.DLL","rpcrt4.dll","nsi.dll","MpOAV.dll","winhttp.dll","dnsapi.dll","uxtheme.dll","ntdll.dll","WindowsCodecs.dll","oleaut32.dll","wbemprox.dll","SHCore.dll","Windows.Globalization.dll","mskeyprotect.dll","kernel32.dll","sspicli.dll","fltLib.dll","fastprox.dll"],"processes":[{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC","name":"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe","normalized_path":"C:\\8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe","pid":1144,"ppid":0,"sha256":"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2","uid":"00000000-00001144"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2026-02-06T19:21:58+00:00","contacted_countries":["USA"],"environment_description":"Windows 11 64 bit","environment_id":140,"id":"69863f547363e69f5a03363f","indicators_count":{"informative":190,"malicious":2,"suspicious":29},"is_in_unified_schema":true,"malware_family":"Trojan.Agent","state":"SUCCESS","submit_name":"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe","tags":["Network Traffic","Extracted Files"],"threat_score":81,"verdict":"malicious"},{"analysis_start_time":"2026-02-06T18:39:40+00:00","contacted_countries":["USA"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"69863569071034fd6e0f7696","indicators_count":{"informative":241,"malicious":2,"suspicious":37},"is_in_unified_schema":true,"malware_family":"Trojan.Agent","state":"SUCCESS","submit_name":"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin","tags":["Network Traffic","Extracted Files"],"threat_score":81,"verdict":"malicious"}],"stats":{"contacted_hosts_count":1,"contacted_urls_count":11,"dns_resolutions_count":1,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":21,"files_deleted_count":0,"files_written_count":88,"http_requests_count":11,"imported_dlls_count":87,"injected_processes_count":0,"mutex_created_count":9,"process_count":1,"registry_keys_created_count":2,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"script_calls_count":0,"spawned_processes_count":1}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"SupportScam_Win32_Screwon_PRP_MTB"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TR/W64.Malware","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"SupportScam_Win32_Screwon_PRP_MTB","verdict":"malicious"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.Agent.tt33","verdict":"malicious"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W64/Trojan3.RBGI","verdict":"malicious"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Contacts 1 domain and 1 host"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"details":[{"detail":"POSTs data to a webserver"}],"details_count":1,"name":"Spyware","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"details_count":1,"name":"Persistence","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"details_count":2,"name":"Evasive","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Impact","technique":"System Shutdown/Reboot"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Information Repositories"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Discovery","technique":"Account Discovery"},{"attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Encrypted/Encoded File"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Reconnaissance","technique":"Gather Victim Network Information"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"},{"type":"informative","value":"Contains ability to retrieve list of TCP/UDP endpoints (API string)"},{"type":"informative","value":"Contains ability to retrieve IPv4 TCP connection table (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Connections Discovery"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Able to retrieve network adapter information (.NET)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Execution","technique":"Component Object Model"},{"attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Mail Protocols"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Keylogging"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to transfer data using curl"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Able to access control system service controller"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1003.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/002","identifiers":[{"type":"informative","value":"Able to access system credential hash file"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Security Account Manager"},{"attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Remote Access Tools"},{"attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Proxy"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Domain Generation Algorithms"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to retrieve security identifier (.NET)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve security identifier details"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credentials from Password Stores"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Resource Development","technique":"Domains"},{"attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Persistence","technique":"Socket Filters"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1070.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/001","identifiers":[{"type":"informative","value":"Able to retrieve event logs (API string)"},{"type":"informative","value":"Able to remove the event logs"},{"type":"informative","value":"Contains ability to delete all entries from an event log (API string)"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Clear Windows Event Logs"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Double File Extension"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Initial Access","technique":"Phishing"},{"attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Management Instrumentation"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Remote Services"},{"attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to retrieve key from a password using PBKDF1 algorithm"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"YARA signature match – Cryptographic hashing algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Opens a handle to the specified local process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Calls an API used to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Local Storage"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to access Windows event information"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"suspicious","value":"Executes WMI queries to gather system information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Tries to GET non-existent files from a webserver"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Command and Control","technique":"DNS"},{"attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Bypass User Account Control"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"suspicious","value":"Contains ability to enumerate processes on remote desktop session hosts"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Able to list processes on remote desktop session host"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel"},{"attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive via Library"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"PCAP contains base64 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Data Encoding"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Create Process with Token"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation"},{"attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"},{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call"},{"attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets"},{"attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Standard Encoding"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"}],"rule_matches":{},"sandbox_signatures":[{"category":"Cryptographic Related","description":"Found reference to API \"SA.EncryptValue and DecryptValue are not supported and throw NotSupportedException. Use RSA.Encrypt and RSA.Decrypt instead.\" (Indicator: \".decrypt\"; Source: \"00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp\")","id":"string-356","level":"informative","mitre_attack_id":"T1140","name":"Able to decrypt/decode data","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001144-00000C2C-797069056\")","id":"string-907","level":"informative","mitre_attack_id":"T1057","name":"Able to enumerate system processes using native API","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"$22","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"trustconnectsoftware.com\"","id":"network-0","level":"informative","mitre_attack_id":"T1071","name":"Contacts domains","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$23","id":"binary-92","level":"informative","mitre_attack_id":"T1027.005","name":"XOR operations in executable file detected","origin":"Binary File","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"QueryServiceStatus\" (File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")\n Found string \"QueryServiceConfig2W\" (File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-910","level":"informative","mitre_attack_id":"T1007","name":"Able to query service configuration on system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Observed unmanaged function \"FCICreate\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FCIAddFile\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FCIFlushCabinet\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FCIFlushFolder\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FCIDestroy\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FDICreate\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FDICopy\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FDIDestroy\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"FDIIsCabinet\" in \"Microsoft.Deployment.Compression.Cab.dll\"\n Observed unmanaged function \"DosDateTimeToFileTime\" in \"Microsoft.Deployment.Compression.dll\"\n Observed unmanaged function \"FileTimeToDosDateTime\" in \"Microsoft.Deployment.Compression.dll\"","id":"static-101","level":"informative","mitre_attack_id":"T1106","name":"Found Native API in Dotnet file","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%ALLUSERSPROFILE%\\TrustConnect (UID: 00000000-00001144)\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%ALLUSERSPROFILE%\\TrustConnect\\QBt4muaH (UID: 00000000-00001144)","id":"api-122","level":"informative","mitre_attack_id":"T1074.001","name":"Calls an API typically used to create a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"$24","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp\")","id":"string-88","level":"informative","mitre_attack_id":"T1056.001","name":"Able to retrieve information about pressed keystrokes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$25","id":"network-60","level":"informative","mitre_attack_id":"T1132","name":"HTTP requests contain Base64 strings","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"g____PInvoke|55_0\" (Indicator: \"evtclearlog\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")\n Found reference to API \"g____PInvoke|49_0\" (Indicator: \"evtsetchannelconfigproperty\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")\n Found reference to API \"EvtClearLog\" (Indicator: \"evtclearlog\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")\n Found reference to API \"EvtSetChannelConfigProperty\" (Indicator: \"evtsetchannelconfigproperty\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")","id":"string-738","level":"informative","mitre_attack_id":"T1070.001","name":"Able to remove the event logs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed dotnet function \"GetFiles\" in \"Microsoft.Deployment.WindowsInstaller.Package.dll\"\n Observed dotnet function \"GetFiles\" in \"Microsoft.Deployment.Compression.dll\"\n Observed dotnet function \"GetDirectories\" in \"Microsoft.Deployment.Compression.dll\"\n Observed dotnet function \"GetDirectories\" in \"ScreenConnect.InstallerActions.dll\"\n Observed dotnet function \"GetFileSystemEntries\" in \"ScreenConnect.InstallerActions.dll\"\n Observed dotnet function \"GetFiles\" in \"ScreenConnect.InstallerActions.dll\"","id":"static-200","level":"informative","mitre_attack_id":"T1082","name":"Able to gather system file/directory information (.NET)","origin":"Static Parser","relevance":3,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"$2b","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"$2c","id":"string-273","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$2d","id":"memorydump-8","level":"informative","mitre_attack_id":"T1055","name":"Found PE header in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2e","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00007964.00000000.160453.B6790000.00000004.mdmp, 00000000-00007964.00000000.160453.BB7D0000.00000004.mdmp, 00000000-00007964.00000001.162375.BB7B0000.00000004.mdmp, 00000000-00007964.00000001.162375.BB801000.00000020.mdmp, 00000000-00007964.00000001.162375.BB831000.00000020.mdmp\")","id":"string-217","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve user privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"VSystem.Net.NetworkInformation.SystemIPGlobalProperties+d__26\" (Source: \"00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp\")","id":"string-941","level":"informative","mitre_attack_id":"T1016","name":"Able to retrieve network adapter information (.NET)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"category":"System Security","description":"$2f","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Able to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"Observed import api \"GetSidSubAuthority\" which can \"return a pointer to a specified subauthority in a security identifier (SID)\" [Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe]\n Observed import api \"GetSidSubAuthorityCount\" which can \"return a pointer to the member in a security identifier (SID) structure that contains the subauthority count\" [Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe]\n Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe]\n Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe]\n Observed import api \"SetKernelObjectSecurity\" which can \"set the security of a kernel object\" [Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe]","id":"static-87","level":"informative","mitre_attack_id":"T1134.001","name":"Imports system security related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$30","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Contains base64 encoded string \"2fQg5/YB/UqJfOPSDFsglA==\" in [Source : PCAP]","id":"string-504","level":"informative","mitre_attack_id":"T1132","name":"PCAP contains base64 strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001144)","id":"api-297","level":"informative","mitre_attack_id":"T1003","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","origin":"API Call","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found string \"DecompressionMethods\" (Source: \"00000000-00001144.00000000.119240.04F60000.00000004.mdmp, 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp, 00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp\")\n Found string \"b__107_0\" (Source: \"00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp\")","id":"string-935","level":"informative","mitre_attack_id":"T1560.002","name":"Able to compress/decompress content at runtime","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-409","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to set file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"$31","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Found HTTPS url \"https://aka.ms\"","id":"string-98","level":"informative","mitre_attack_id":"T1573","name":"Possibly tries to communicate over SSL connection (HTTPS)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"SELECT UUID FROM Win32_ComputerSystemProduct\" (Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp, 00000000-00001144.00000001.121162.04D91000.00000004.mdmp, 00000000-00001144.00000002.123083.04AE0000.00000004.mdmp, 00000000-00001144.00000002.123083.04E29000.00000004.mdmp, Indicator: \"select uuid from win32_computersystemproduct\")","id":"string-16","level":"informative","mitre_attack_id":"T1213","name":"Contains SQL queries","origin":"File/Memory","relevance":2,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$32","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" issued a query \"SELECT UUID FROM Win32_ComputerSystemProduct\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" issued a query \"SELECT Name FROM Win32_Processor\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" issued a query \"SELECT TotalPhysicalMemory FROM Win32_ComputerSystem\"","id":"api-183","level":"suspicious","mitre_attack_id":"T1082","name":"Executes WMI queries to gather system information","origin":"API Call","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAlloc\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Able to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at DE210000\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at DD250000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature matched on embedded PE in file \"sample.bin\"","id":"yara-140","level":"informative","mitre_attack_id":"T1027.009","name":"YARA signature match – Embedded PE executable","origin":"YARA Signature","relevance":2,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"g____PInvoke|3_0\" (Indicator: \"GetNumberOfEventLogRecords\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")\n Found reference to API \"g____PInvoke|7_0\" (Indicator: \"OpenEventLog\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")\n Found reference to API \"OpenEventLogW\" (Indicator: \"OpenEventLog\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")\n Found reference to API \"OpenEventLog\" (Indicator: \"OpenEventLog\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")\n Found reference to API \"GetNumberOfEventLogRecords\" (Indicator: \"GetNumberOfEventLogRecords\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")\n Found reference to API \"OpenEventLogWT\" (Indicator: \"OpenEventLog\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")","id":"string-237","level":"informative","mitre_attack_id":"T1070.001","name":"Able to retrieve event logs (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"TRUSTCONNECTAGENT_QBT4MUAH\"; Value: \"C:\\8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"registry-136","level":"informative","mitre_attack_id":"T1112","name":"Writes registry keys","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed Namespace \"System.Security.Principal.SecurityIdentifier\" and MemberReference \".ctor\" in \"ScreenConnect.ClientService.dll\"","id":"static-156","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve security identifier details","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Observed function \"Process.Start\" in \"ScreenConnect.WindowsFileManager.exe\"","id":"static-111","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to start a process (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"$33","id":"network-2","level":"informative","mitre_attack_id":"T1071.001","name":"GETs files from a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$34","id":"api-104","level":"suspicious","mitre_attack_id":"T1057","name":"Calls an API typically used to enumerate process encountered in a system snapshot","origin":"API Call","relevance":5,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature match for cryptographic hashing algorithm process \"00000000-00001144\"","id":"yara-173","level":"suspicious","mitre_attack_id":"T1027","name":"YARA signature match – Cryptographic hashing algorithm","origin":"YARA Signature","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001144.00000000.119240.02481000.00000020.mdmp, 00000000-00001144.00000000.119240.02870000.00000004.mdmp, 00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000001.121162.00550000.00000004.mdmp, 00000000-00001144.00000001.121162.02390000.00000004.mdmp, 00000000-00001144.00000001.121162.02410000.00000004.mdmp, 00000000-00001144.00000001.121162.06031000.00000020.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp, 00000000-00001144.00000002.123083.06050000.00000004.mdmp, 00000000-00001144.00000002.123083.06080000.00000004.mdmp, 00000000-00001144.00000002.123083.06111000.00000020.mdmp\")","id":"string-107","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host's architecture (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe]","id":"static-189","level":"informative","mitre_attack_id":"T1057","name":"Calls an API used to retrieve process information","origin":"Static Parser","relevance":5,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"TRUSTCONNECTAGENT_QBT4MUAH\"; Value: \"C:\\8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"registry-113","level":"suspicious","mitre_attack_id":"T1547","name":"Tries to save executable or command in registry","origin":"Registry Access","relevance":7,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string(File: \"ScreenConnect.WindowsFileManager.exe\")\n file/memory contains long string(File: \"ScreenConnect.WindowsBackstageShell.exe\")","id":"string-934","level":"informative","mitre_attack_id":"T1106","name":"Able to execute applications using .NET process API","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"$35","id":"registry-18","level":"informative","mitre_attack_id":"T1012","name":"Accesses Software Policy Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"\"@xr_. X\"3\", \"g]yo\"","id":"network-20","level":"informative","mitre_attack_id":"T1132.001","name":"HTTP request contains Base64 encoded artifacts","origin":"Network Traffic","relevance":7,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Found string - \\\\.\\pipe\\dotnet-diagnostic-1144","id":"string-146","level":"informative","mitre_attack_id":"T1559","name":"Found named pipe like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001144.00000000.119240.02010000.00000004.mdmp, 00000000-00001144.00000001.121162.02010000.00000004.mdmp, 00000000-00001144.00000002.123083.02010000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEEF08EB5027EAF316D2817A5CDB76]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001144.00000000.119240.02010000.00000004.mdmp, 00000000-00001144.00000001.121162.02010000.00000004.mdmp, 00000000-00001144.00000002.123083.02010000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEEF08EB5027EAF316D2817A5CDB76]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001144.00000000.119240.04AE0000.00000004.mdmp, 00000000-00001144.00000002.123083.04D91000.00000004.mdmp, 00000000-00001144.00000002.123083.04E29000.00000004.mdmp, 00000000-00001144.00000002.123083.063D0000.00000004.mdmp\")\n Found string \"B+ncalrpc:[O\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001144.00000000.119240.04AE0000.00000004.mdmp\")","id":"string-531","level":"informative","mitre_attack_id":"T1090","name":"Contains references to RPC protocol sequence strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" trying to touch file \"C:\\Windows\\System32\\cryptsp.dll\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" trying to touch file \"\\Global??\\FltMgrMsg\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" trying to touch file \"C:\\8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" trying to touch file \"\\Device\\CNG\"","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"$36","id":"network-4","level":"suspicious","mitre_attack_id":"T1041","name":"POSTs data to a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"HTTPS traffic to \"178.128.69.245\" on port \"443\"","id":"network-38","level":"informative","mitre_attack_id":"T1573","name":"Uses HTTPS for communication","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$37","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found api reference \"fc2898DeriveBytes.CryptDeriveKey is obsolete and is not supported. Use PasswordDeriveBytes.CryptDeriveKey instead.\" (Indicator: \"CryptDeriveKey\"; Source: \"00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp\")\n Found api reference \"Rfc2898CryptDeriveKeyDiagId\" (Indicator: \"CryptDeriveKey\"; Source: \"00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp\")\n Found api reference \"Rfc2898CryptDeriveKeyMessage\" (Indicator: \"CryptDeriveKey\"; Source: \"00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp\")\n Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00001144.00000000.119240.04AE0000.00000004.mdmp\")","id":"string-602","level":"informative","mitre_attack_id":"T1573","name":"Able to use Microsoft's Enhanced Cryptographic Provider","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for RSA public and private key matched on process \"00000000-00001144\"\n YARA signature for RSA public and private key matched on file \"sample.bin\"","id":"yara-62","level":"informative","mitre_attack_id":"T1027","name":"YARA signature match - RSA algorithm (keys)","origin":"YARA Signature","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" issued a query \"SELECT UUID FROM Win32_ComputerSystemProduct\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" issued a query \"SELECT Name FROM Win32_Processor\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" issued a query \"SELECT TotalPhysicalMemory FROM Win32_ComputerSystem\"","id":"api-57","level":"suspicious","mitre_attack_id":"T1047","name":"Executes WMI queries known to be used for VM detection","origin":"API Call","relevance":10,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"category":"General","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" with parameter \\\\?\\%ALLUSERSPROFILE%\\TrustConnect (UID: 00000000-00001144)\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" with parameter \\\\?\\%ALLUSERSPROFILE%\\TrustConnect\\QBt4muaH (UID: 00000000-00001144)","id":"api-318","level":"informative","mitre_attack_id":"T1074.001","name":"Creates directory on disk","origin":"API Call","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found string \"WMI.ExecQuery(SELECT UUID FROM Win32_ComputerSystemProduct);\" (Indicator: \"wmi.exe\"; in Source: \"00000000-00001144.00000000.119240.02010000.00000004.mdmp, 00000000-00001144.00000001.121162.02010000.00000004.mdmp, 00000000-00001144.00000002.123083.02105000.00000004.mdmp\")","id":"string-30","level":"suspicious","mitre_attack_id":"T1047","name":"Contains references to WMI/WMIC","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"config.json\" has type \"JSON text data\"- Location: [%ALLUSERSPROFILE%\\TrustConnect\\QBt4muaH\\config.json]- [targetUID: 00000000-00001144]\n \"device.id\" has type \"ASCII text with no line terminators\"- Location: [%ALLUSERSPROFILE%\\TrustConnect\\QBt4muaH\\device.id]- [targetUID: 00000000-00001144]","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found system information discovery API: \"GetSystemInfo\" in file \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\"","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-208","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to show a graphical window (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"ScreenConnect.ClientService.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MSI5B8B.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MSI7282.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$38","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Able to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-201","level":"informative","mitre_attack_id":"T1614","name":"Able to query system locale information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"GetExecutingAssembly\"; File: \"ScreenConnect.WindowsFileManager.exe\")\n file/memory contains long string with (Indicator: \"GetExecutingAssembly\"; File: \"ScreenConnect.WindowsBackstageShell.exe\")","id":"string-615","level":"informative","mitre_attack_id":"T1620","name":"Can load assembly that contains the code that is currently executing (Dotnet)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x1405c32e4,add\trsp, 0x28,jmp\t0x1405c2c6c,int3\t,int3\t,sub\trsp, 0x28,call\t0x1402b4a70,jmp\t0x1405c2e11,xor\teax, eax,add\trsp, 0x28,ret\t,int3\t,int3\t,mov\tqword ptr [rsp + 0x10], rbx,mov\tqword ptr [rsp + 0x18], rbp,mov\tqword ptr [rsp + 0x20], rsi,push\trdi,sub\trsp, 0x10,xor\teax, eax,xor\tecx, ecx,cpuid\t,xor\tecx, 0x6c65746e,xor\tedx, 0x49656e69,or\tedx, ecx,mov\tebp, eax,mov\teax, 1,xor\tebx, 0x756e6547,or\tedx, ebx,lea\tecx, [rax - 1],cpuid\t,\"","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"WMI.ExecQuery(SELECT UUID FROM Win32_ComputerSystemProduct);\" (Indicator: \" win32_computersystem\"; Source: \"00000000-00001144.00000000.119240.02010000.00000004.mdmp, 00000000-00001144.00000001.121162.02010000.00000004.mdmp, 00000000-00001144.00000002.123083.02105000.00000004.mdmp\")\n \"SELECT UUID FROM Win32_ComputerSystemProduct\" (Indicator: \" win32_computersystem\"; Source: \"00000000-00001144.00000000.119240.04AE0000.00000004.mdmp, 00000000-00001144.00000001.121162.04D91000.00000004.mdmp, 00000000-00001144.00000002.123083.04AE0000.00000004.mdmp, 00000000-00001144.00000002.123083.04E29000.00000004.mdmp\")\n \"instance of Win32_ComputerSystemProduct\" (Indicator: \" win32_computersystem\"; Source: \"00000000-00001144.00000000.119240.04AE0000.00000004.mdmp\")","id":"string-55","level":"suspicious","mitre_attack_id":"T1047","name":"Found a reference to a WMI query string known to be used for VM detection","origin":"File/Memory","relevance":10,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","id":"yara-542","level":"informative","mitre_attack_id":"T1027","name":"YARA signature match - Djb2 Hash Algorithm","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001144)","id":"api-296","level":"informative","mitre_attack_id":"T1497","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"API Call","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"trustconnectsoftware.com\"","id":"network-51","level":"informative","mitre_attack_id":"T1071.004","name":"Queries DNS server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"$39","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"$3a","id":"string-457","level":"informative","mitre_attack_id":"T1071.001","name":"Found string related to HTTP headers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"g____PInvoke|0_0\" (Indicator: \"ClearEventLog\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")\n Found reference to API \"ClearEventLogW\" (Indicator: \"ClearEventLog\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")\n Found reference to API \"ClearEventLog\" (Indicator: \"ClearEventLog\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")\n Found reference to API \"ClearEventLogWT\" (Indicator: \"ClearEventLog\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")","id":"string-211","level":"informative","mitre_attack_id":"T1070.001","name":"Contains ability to delete all entries from an event log (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-168","level":"informative","mitre_attack_id":"T1134.002","name":"Contains ability to create process with token (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"GET /agent-update?version=6.1.0&token=QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X HTTP/1.1\n\n GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1\n\n GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1\n\n GET /api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1\n\n GET /ws/screen?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1\nHost: trustconnectsoftware.com\nConnection: Upgrade\nUpgrade: websocket\nSec-WebSocket-Key: 2fQg5/YB/UqJfOPSDFsglA==\nSec-WebSocket-Version: 13\n","id":"network-72","level":"informative","mitre_attack_id":"T1071.001","name":"GETs files from a webserver (HTTPS)","origin":"Network Traffic","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$3b","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp, 00000000-00001144.00000002.123083.10AD8000.00000002.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"\"5.27.0.0\"\n \"8.0.0.0\"\n \"192.168.0.2\"\n \"27.0.0.1\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"ScreenConnect.WindowsFileManager.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"ScreenConnect.ClientService.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"Microsoft.Deployment.WindowsInstaller.Package.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"Microsoft.Deployment.Compression.Cab.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"Microsoft.Deployment.Compression.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"ScreenConnect.InstallerActions.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","id":"static-144","level":"informative","name":"PE file contains COM data directory","origin":"Static Parser","sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001144-00000C2C-872787116\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001144.00000000.119240.04F60000.00000004.mdmp\n 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001144.00000000.119240.05000000.00000004.mdmp\n 00000000-00001144.00000002.123083.051B1000.00000020.mdmp\n 00000000-00001144.00000002.123083.06080000.00000004.mdmp\n 00000000-00001144.00000002.123083.06111000.00000020.mdmp","id":"string-406","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to shutdown system","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"The input sample is signed with a certificate issued by \"CN=E7, O=Let's Encrypt, C=US\" (SHA1: D7:50:5D:7C:17:B8:83:0C:1A:D3:34:CF:4C:91:3C:F5:D6:E2:0C:B5; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: 3B:73:C1:7E:3D:F8:7C:F3:AA:77:F1:38:92:19:EB:5E:DD:51:9E:7F; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Certum Trusted Network CA 2, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL\" (SHA1: 0C:71:7E:57:7F:49:34:3A:5A:2B:93:A7:D5:E8:58:6D:44:45:12:A1; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Certum Extended Validation Code Signing 2021 CA, O=Asseco Data Systems S.A., C=PL\" (SHA1: B4:2F:80:AD:51:0E:09:77:AF:AE:67:2B:B8:6F:A8:C8:CD:62:E8:66; see report for more information)","id":"certificate-0","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$3c","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"External Systems","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","id":"suricata-0","level":"informative","name":"Detected Suricata Alert","origin":"Suricata Alerts","relevance":10,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-242","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to close a handle to a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-131","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"ScreenConnect.ClientService.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"ScreenConnect.WindowsFileManager.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Microsoft.Deployment.WindowsInstaller.Package.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"Microsoft.Deployment.Compression.Cab.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"Microsoft.Deployment.Compression.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"ScreenConnect.InstallerActions.dll\" was detected as \"Microsoft visual C# / Basic .NET\"\n \"MSI5B8B.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"MSI7282.tmp\" was detected as \"Borland Delphi 3.0 (???)\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","id":"static-154","level":"informative","name":"File contains dynamic base/NX flags","origin":"Static Parser","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$3d","id":"string-280","level":"informative","mitre_attack_id":"T1486","name":"Contains reference to cryptographic keys","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001144)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"$3e","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"$3f","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"ScreenConnect.WindowsCredentialProvider.dll\" claimed CRC 906424 while the actual is CRC 36380343\n \"ScreenConnect.WindowsAuthenticationPackage.dll\" claimed CRC 272565 while the actual is CRC 906424\n \"ScreenConnect.ClientService.exe\" claimed CRC 155355 while the actual is CRC 272565\n \"ScreenConnect.WindowsFileManager.exe\" claimed CRC 104759 while the actual is CRC 155355\n \"ScreenConnect.ClientService.dll\" claimed CRC 113680 while the actual is CRC 104759\n \"Microsoft.Deployment.WindowsInstaller.Package.dll\" claimed CRC 95386 while the actual is CRC 113680\n \"Microsoft.Deployment.Compression.Cab.dll\" claimed CRC 74768 while the actual is CRC 95386\n \"Microsoft.Deployment.Compression.dll\" claimed CRC 66244 while the actual is CRC 74768\n \"ScreenConnect.InstallerActions.dll\" claimed CRC 55542 while the actual is CRC 66244\n \"MSI5B8B.tmp\" claimed CRC 193043 while the actual is CRC 55542","id":"static-0","level":"suspicious","mitre_attack_id":"T1027","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$40","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"$41","id":"api-22","level":"informative","mitre_attack_id":"T1129","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-426","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to modify file attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"Client.resources has high entropy\"","id":"binary-90","level":"informative","mitre_attack_id":"T1027.013","name":"Drops file with high entropy, indicating encryption/obfuscation","origin":"Binary File","relevance":3,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"$42","id":"yara-553","level":"suspicious","name":"Yara Signature Match - Indicators","origin":"YARA Signature","relevance":9,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable for MS Windows 6.01 (DLL)\n x86-64\n 6 sections","id":"static-97","level":"malicious","mitre_attack_id":"T1027.009","name":"PE file contains executable resources","origin":"Static Parser","relevance":10,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"CoGetObjectContext\" (Indicator: \"CoGetObject\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-239","level":"informative","mitre_attack_id":"T1548.002","name":"Contains ability to bypass UAC using COM object (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"POST /api/agents/heartbeat HTTP/1.1\nHost: trustconnectsoftware.com\nTransfer-Encoding: chunked\nContent-Type: application/json; charset=utf-8\"\n \"GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1\"\n \"GET /api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621 HTTP/1.1\"","id":"network-3","level":"informative","mitre_attack_id":"T1071.001","name":"Tries to GET non-existent files from a webserver","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$43","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00001144-00000C2C-797930165\")","id":"string-879","level":"informative","mitre_attack_id":"T1205.002","name":"Able to monitor socket connection","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001144.00000000.119240.04EF1000.00000020.mdmp, 00000000-00001144.00000000.119240.CFC73000.00000002.mdmp, 00000000-00001144.00000001.121162.04F10000.00000004.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"RegOpenKeyExW\n OpenProcessToken\n RegCloseKey\n SetKernelObjectSecurity\n GetSystemInfo\n GetModuleHandleExW\n MapViewOfFileEx\n VirtualProtect\n LoadLibraryW\n LoadLibraryExW\n SleepEx\n ConnectNamedPipe\n CreateDirectoryW\n FindFirstFileExW\n GetModuleHandleW\n OutputDebugStringA\n CreateProcessW\n GetProcAddress\n GetTempPathW\n CreateFileA\n LoadLibraryA\n GetCommandLineW\n LoadLibraryExA\n CreateFileW\n GetThreadContext\n GetTickCount64\n FindResourceW\n CreateThread\n IsDebuggerPresent\n SleepConditionVariableSRW\n GetModuleFileNameW\n GetFileAttributesExW\n CreateThreadpoolTimer\n CreateFileMappingW\n MapViewOfFile\n DisconnectNamedPipe\n GetFileSize\n VirtualAllocExNuma\n UnhandledExceptionFilter\n OutputDebugStringW\n WriteFile\n ExitThread\n VirtualAlloc\n FindNextFileW\n CreateFileMappingA\n GetFileSizeEx\n TerminateProcess\n Sleep\n GetTickCount\n ShellExecuteW","id":"static-1","level":"suspicious","mitre_attack_id":"T1106","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"TRUSTCONNECTAGENT_QBT4MUAH\"; Value: \"C:\\8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"registry-0","level":"suspicious","mitre_attack_id":"T1547.001","name":"Modifies auto-execute functionality by setting/creating a value in the registry","origin":"Registry Access","relevance":8,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SeLockMemoryPrivilege\" (Indicator: \"SeLockMemoryPrivilege\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-97","level":"informative","mitre_attack_id":"T1548","name":"Contains ability to use security policy setting (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1068","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"Call to IsWow64Process2 failed: %u\" (Indicator: \"IsWow64Process\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-450","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to determine if process is running under WOW64 (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000001.121162.10900000.00000002.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp, 00000000-00001144.00000002.123083.10AD8000.00000002.mdmp\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Observed function \"ToBase64String\" in \"ScreenConnect.ClientService.dll\"","id":"static-106","level":"informative","mitre_attack_id":"T1140","name":"Able to decode string content at runtime (.NET)","origin":"Static Parser","relevance":5,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed function \"get_MachineName\" in \"ScreenConnect.ClientService.dll\"","id":"static-120","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to gather system information (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001144)","id":"api-111","level":"informative","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$44","id":"string-937","level":"informative","mitre_attack_id":"T1082","name":"Able to gather system information (.NET)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$45","id":"string-507","level":"informative","mitre_attack_id":"T1082","name":"References to WMI query strings used for information discovery","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Found HTTPS POST request to https://trustconnectsoftware.com/api/agents/heartbeat\n Found HTTPS POST request to https://trustconnectsoftware.com/api/agents/register\n Found HTTPS GET request to https://trustconnectsoftware.com/agent-update?version=6.1.0&token=QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X\n Found HTTPS GET request to https://trustconnectsoftware.com/api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621\n Found HTTPS GET request to https://trustconnectsoftware.com/api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621\n Found HTTPS GET request to https://trustconnectsoftware.com/api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621\n Found HTTPS GET request to https://trustconnectsoftware.com/ws/screen?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621","id":"network-66","level":"informative","mitre_attack_id":"T1071.001","name":"Sends GET/POST requests (HTTPS)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found string \"GetCursorPosition\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00001144.00000000.119240.047B1000.00000020.mdmp, 00000000-00001144.00000002.123083.04780000.00000004.mdmp\")","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$46","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed string: \"curL\" (Indicator: \"curl\") in Source: 00000000-00007964.00000000.160453.B75D0000.00000004.mdmp\n 00000000-00007964.00000001.162375.B75F6000.00000004.mdmp\n 00000000-00007964.00000002.164294.B7627000.00000004.mdmp","id":"string-576","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to transfer data using curl","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"file/memory contains long string(File: \"ScreenConnect.ClientService.dll\")","id":"string-945","level":"informative","mitre_attack_id":"T1033","name":"Able to retrieve security identifier (.NET)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed process enumerate api used in \"kernel32.dll\" [Source: ScreenConnect.WindowsCredentialProvider.dll]","id":"static-209","level":"suspicious","mitre_attack_id":"T1057","name":"Contains ability to enumerate processes on remote desktop session hosts","origin":"Static Parser","relevance":3,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","id":"network-54","level":"informative","mitre_attack_id":"T1573","name":"Makes HTTPS connections using secure TLS/SSL version","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed namespace \"System.Net\" in \"ScreenConnect.ClientService.dll\"","id":"static-110","level":"informative","mitre_attack_id":"T1071.001","name":"Contains ability to provide interface for network protocols (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"currentHash\" (Indicator: \"nthash\"; Source: \"00000000-00007964.00000000.160453.B59C0000.00000004.mdmp\")","id":"string-867","level":"informative","mitre_attack_id":"T1003.002","name":"Able to access system credential hash file","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" queries basic process information of the \"C:\\8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (UID: 1144)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-191","level":"informative","mitre_attack_id":"T1007","name":"Able to enumerate service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteSubKey\" in \"ScreenConnect.ClientService.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"ScreenConnect.ClientService.dll\"","id":"static-139","level":"informative","mitre_attack_id":"T1112","name":"Dotnet code contains ability to modify/delete registry","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"ScreenConnect.WindowsFileManager.exe\" claims program is from Thu Dec 14 14:47:59 2056\n \"ScreenConnect.ClientService.dll\" claims program is from Mon Mar 3 23:29:17 2092\n \"ScreenConnect.InstallerActions.dll\" claims program is from Sat Feb 23 21:36:45 2064","id":"static-3","level":"suspicious","mitre_attack_id":"T1027","name":"Timestamp in PE header is very old or in the future","origin":"Static Parser","relevance":10,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\wminet_utils.dll\" [Source: 00000000-00001144-00000C2B-794788808]\n Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00001144-00000C2B-795261068]\n Observed system executable string:\"%WINDIR%\\system32\\en-US\\tzres.dll.mui\" [Source: 00000000-00001144-00000C2B-800943374]","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows file paths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" has a TLS callback with entrypoint at 0x1405c2270\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" has a TLS callback with entrypoint at 0x1405c2a30","id":"static-17","level":"suspicious","mitre_attack_id":"T1055.005","name":"Found TLS callbacks","origin":"Static Parser","relevance":10,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"category":"General","description":"$47","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NAME\")\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTcpTable\" (Indicator: \"GetTcpTable\"; Source: \"00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp\")\n Found reference to API \"g____PInvoke|53_0\" (Indicator: \"GetTcpTable\"; Source: \"00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp\")","id":"string-119","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to retrieve IPv4 TCP connection table (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$48","id":"string-475","level":"informative","mitre_attack_id":"T1555","name":"Contains string like password/secret","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-452","level":"informative","mitre_attack_id":"T1087","name":"Contains ability to retrieve SID for the specified name (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 178.128.69.245 on port 443 is sent without HTTP header","id":"network-23","level":"suspicious","mitre_attack_id":"T1071.001","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" issued a query \"SELECT UUID FROM Win32_ComputerSystemProduct\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" issued a query \"SELECT Name FROM Win32_Processor\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" issued a query \"SELECT TotalPhysicalMemory FROM Win32_ComputerSystem\"","id":"api-56","level":"informative","mitre_attack_id":"T1047","name":"Executes WMI queries","origin":"API Call","relevance":10,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed import api PathFindFileName (Source: ScreenConnect.ClientService.exe)","id":"static-183","level":"informative","mitre_attack_id":"T1083","name":"Calls APIs used for find file/directory path","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"GetWindowsDirectory failed. Error code: %d\" (Indicator: \"GetWindowsDirectory\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$49","id":"api-9","level":"informative","mitre_attack_id":"T1057","name":"Queries process information","origin":"API Call","relevance":4,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-439","level":"informative","mitre_attack_id":"T1055.003","name":"Able to modify process memory (API string)","origin":"File/Memory","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-309","level":"informative","mitre_attack_id":"T1055.003","name":"Able to modify thread functionality – possible hijack (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$4a","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Virtual size of \".text\" is \"0x60d91c\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x17ea14\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x14948c\" greater than 0x100000","id":"static-124","level":"informative","name":"PE file has a big virtual size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\dotnet-diagnostic-1144\" - (UID: 00000000-00001144)","id":"api-138","level":"informative","mitre_attack_id":"T1570","name":"Calls an API typically used to create an instance of a named pipe","origin":"API Call","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Observed function \"ResourceManagerEx.GetObject\" in \"ScreenConnect.ClientService.dll\"","id":"static-112","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to load content from resource","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"$4b","id":"string-899","level":"informative","mitre_attack_id":"T1071","name":"Contains references to network communication API (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"g____PInvoke|185_0\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp\")\n Found reference to API \"g____PInvoke|186_0\" (Indicator: \"WinHttpCloseHandle\"; Source: \"00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp\")\n Found reference to API \"g____PInvoke|207_0\" (Indicator: \"WinHttpGetIEProxyConfigForCurrentUser\"; Source: \"00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp\")","id":"string-323","level":"informative","mitre_attack_id":"T1071.001","name":"Contains reference to Windows HTTP services (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"$4c","id":"mutant-0","level":"informative","mitre_attack_id":"T1480","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-209","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to start a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"LsaGetLogonSessionData\" (Indicator: \"GetLogonSessionData\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-117","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to enumerate logon sessions (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-183","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to check debugger is running (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$4d","id":"static-107","level":"informative","mitre_attack_id":"T1140","name":"Able to load content into memory (.NET)","origin":"Static Parser","relevance":5,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" writes file \"c:\\programdata\\trustconnect\\qbt4muah\\config.json\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" writes file \"c:\\programdata\\trustconnect\\qbt4muah\\device.id\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" writes file \"%allusersprofile%\\trustconnect\\qbt4muah\\config.json\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" writes file \"%allusersprofile%\\trustconnect\\qbt4muah\\device.id\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-354","level":"informative","mitre_attack_id":"T1082","name":"Contains reference to mutex-related activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" contains export function called \"CLRJitAttachState\" at ordinal 3\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" contains export function called \"DotNetRuntimeInfo\" at ordinal 4\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" contains export function called \"MetaDataGetDispenser\" at ordinal 5\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" contains export function called \"g_CLREngineMetrics\" at ordinal 2\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" contains export function called \"g_dacTable\" at ordinal 6","id":"static-78","level":"informative","name":"Contains export functions","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"details too long to display","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed email domain:\"ystem.net.mail.dll\" [Source: 00000000-00007964.00000000.160453.1ED10000.00000004.mdmp\n 00000000-00007964.00000001.162375.1ED10000.00000004.mdmp\n 00000000-00007964.00000002.164294.1ED10000.00000004.mdmp]","id":"string-169","level":"informative","mitre_attack_id":"T1071.003","name":"Found mail related domain names","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","id":"network-55","level":"informative","name":"JA3 SSL client fingerprint","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" opens a process \"C:\\VxStream\\VxKernelSvcNTMgr.exe\" (UID: 00000000-00001144)","id":"api-284","level":"suspicious","mitre_attack_id":"T1489","name":"Opens a handle to the specified local process","origin":"API Call","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"ScreenConnect.WindowsBackstageShell.exe\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-906","level":"informative","mitre_attack_id":"T1057","name":"Able to list processes on remote desktop session host","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string(File: \"ScreenConnect.ClientService.exe\")","id":"string-930","level":"informative","mitre_attack_id":"T1059.003","name":"Able to retrieve command line parameters of the running process","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"RepositoryUrl!https://github.com/dotnet/runtime\" (Indicator: \"github.com\")\n \"_type is annotated as preserve All members, so any Types returned from GetInterfaces should be preserved as well once https://github.com/mono/linker/issues/1731 is fixed.\" (Indicator: \"github.com\")\n \"Calling _type.Assembly.GetType on a non-assembly qualified type will still work. See https://github.com/mono/linker/issues/1895v\" (Indicator: \"github.com\")\n \"Justification\\Suppressing the warning until gets fixed, see https://github.com/dotnet/runtime/issues/50821\" (Indicator: \"github.com\")","id":"string-135","level":"informative","name":"Found well known domains (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","id":"yara-26","level":"informative","mitre_attack_id":"T1027.009","name":"YARA signature match - PE executable embedded in .rsrc section","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" called \"IsWow64Process\" with parameter \"1144\" - (UID: 00000000-00001144)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; Source: \"00000000-00001144.00000000.119240.01200000.00000004.mdmp, 00000000-00001144.00000000.119240.04F60000.00000004.mdmp, 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp, 00000000-00001144.00000000.119240.05570000.00000004.mdmp, 00000000-00001144.00000000.119240.055A1000.00000020.mdmp\")","id":"string-222","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve network parameters of a computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00001144.00000000.119240.04AE0000.00000004.mdmp\n 00000000-00001144.00000002.123083.04AE0000.00000004.mdmp","id":"string-231","level":"informative","mitre_attack_id":"T1562.001","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"$4e","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001144.00000000.119240.02010000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000002.123083.04AE0000.00000004.mdmp\")\n Found string \"kerberosnegotiategotiate kerberosnegotiategotiate2\" (Indicator: \"kerberos\"; Source: \"00000000-00001144.00000000.119240.04F60000.00000004.mdmp, 00000000-00001144.00000000.119240.04FA1000.00000020.mdmp\")","id":"string-868","level":"informative","mitre_attack_id":"T1558","name":"Able to access credential file using Kerberos","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference string \"ERROR_EVT_INVALID_EVENT_DATA\" (Indicator: \"error_evt_invalid_event_data\"; Source: \"00000000-00007964.00000000.160453.B9A60000.00000004.mdmp\")","id":"string-977","level":"informative","mitre_attack_id":"T1082","name":"Able to access Windows event information","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"178.128.69.245:443\"","id":"network-1","level":"informative","mitre_attack_id":"T1071","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"CreateServiceProvider\" (Indicator: \"CreateService\"; Source: \"00000000-00001144.00000000.119240.00420000.00000004.mdmp, 00000000-00001144.00000002.123083.00500000.00000004.mdmp\")","id":"string-199","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"$4f","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$50","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$51","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Contacted Domain: \"trustconnectsoftware.com\" has been identified as malicious","id":"network-88","level":"malicious","mitre_attack_id":"T1566","name":"Application communicates with a malicious domain","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00001144-00000C2C-797624515\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001144-00000C2C-797899036\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00001144-00000C2C-800552556\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00001144-00000C2C-800555131\")\n Found reference to API \"g____PInvoke|185_0\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp\")","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Contacted domain: \"trustconnectsoftware.com\" has high entropy","id":"network-81","level":"informative","mitre_attack_id":"T1568.002","name":"High entropy domain detected","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" has an writable section named \".data\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" has an writable section named \".didat\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" has an writable section named \"Section\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","id":"summary-27","level":"informative","mitre_attack_id":"T1119","name":"Shows ability to send encrypted data to the internet","origin":"Indicator Combinations","relevance":2,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-193","level":"informative","mitre_attack_id":"T1082","name":"Able to query volume/memory size (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe)","id":"static-79","level":"informative","mitre_attack_id":"T1027.007","name":"Contains ability to dynamically determine API calls","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at DE4B0000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"$52","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-192","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to modify system service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"$53","id":"memorydump-10","level":"informative","mitre_attack_id":"T1012","name":"Found registry location strings in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"ffffffff8e010960\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","id":"api-105","level":"suspicious","mitre_attack_id":"T1113","name":"Calls an API possibly used to take screenshots","origin":"API Call","relevance":5,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"ScreenConnect.WindowsFileManager.exe\"","id":"static-108","level":"informative","mitre_attack_id":"T1106","name":"Able to execute application (.NET)","origin":"Static Parser","relevance":3,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"ScreenConnect.WindowsBackstageShell.exe.config\" has type \"XML 1.0 document ASCII text with CRLF line terminators\"\n \"app.config\" has type \"XML 1.0 document ASCII text with CRLF line terminators\"\n \"system.config\" has type \"XML 1.0 document ASCII text with very long lines (459) with CRLF line terminators\"\n \"CustomAction.config\" has type \"XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators\"\n \"ScreenConnect.WindowsFileManager.exe.config\" has type \"XML 1.0 document ASCII text with CRLF line terminators\"\n \"ScreenConnect.WindowsClient.exe.config\" has type \"XML 1.0 document ASCII text with CRLF line terminators\"","id":"binary-39","level":"informative","mitre_attack_id":"T1105","name":"Drops XML files","origin":"Binary File","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"Found string \"System.Runtime.Remoting\" (Source: \"00000000-00007964.00000000.160453.20810000.00000004.mdmp\")","id":"string-940","level":"informative","mitre_attack_id":"T1021","name":"Able to modify Remote Configuration","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ScreenConnect.WindowsCredentialProvider.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ScreenConnect.WindowsAuthenticationPackage.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ScreenConnect.ClientService.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: MSI5B8B.tmp]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: MSI7282.tmp]","id":"static-88","level":"informative","mitre_attack_id":"T1059.003","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" has high imagebase \"0x140000000\"","id":"static-93","level":"informative","name":"PE file has a high image base","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" called \"GetComputerNameW\" (UID: 00000000-00001144)","id":"api-141","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve computer name","origin":"API Call","relevance":2,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"External Systems","description":"1/27 Antivirus vendors marked sample as malicious (3% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe]","id":"static-191","level":"informative","mitre_attack_id":"T1489","name":"Calls an API used to open a process handle","origin":"Static Parser","relevance":5,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"TaskList\" (Indicator: \"tasklist\"; Source: \"00000000-00001144.00000000.119240.04951000.00000020.mdmp, 00000000-00001144.00000001.121162.04890000.00000004.mdmp\")\n Found string \"eceived PING frame, content:\" (Indicator: \"ping\"; Source: \"00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp\")\n Found string \"FlowControl] Sending RTT PING with payload\" (Indicator: \"ping\"; Source: \"00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp\")\n Found string \"FlowControl] Unexpected PING ACK in state\" (Indicator: \"ping\"; Source: \"00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp\")\n Found string \"FlowControl] Unexpected RTT PING ACK payload\" (Indicator: \"ping\"; Source: \"00000000-00001144.00000000.119240.05000000.00000004.mdmp, 00000000-00001144.00000002.123083.051B1000.00000020.mdmp\")","id":"string-126","level":"informative","mitre_attack_id":"T1082","name":"Found system command-related strings","origin":"File/Memory","relevance":7,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-544","level":"informative","mitre_attack_id":"T1569.002","name":"Contains ability to open a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"ScreenConnect.WindowsCredentialProvider.dll\" contains export function called \"DllGetClassObject\" at ordinal 1","id":"static-177","level":"informative","mitre_attack_id":"T1559.001","name":"Contains ability to retrieve class object from a DLL object handler","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001144-00000C2C-797069056\")","id":"string-659","level":"informative","mitre_attack_id":"T1497.001","name":"Able to identify virtual environment by using API string","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Raw size of \".text\" is \"0x60da00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x17ec00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x149600\" greater than 0x100000","id":"static-125","level":"informative","name":"PE file has a big raw size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Found http requests in header \"POST /api/agents/heartbeat\"\n Found http requests in header \"POST /api/agents/register\"\n Found http requests in header \"GET /agent-update?version=6.1.0&token=QBt4muaH2HJfuy4gzlgi5uAOMwPzFA0X\"\n Found http requests in header \"GET /api/files/browse/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621\"\n Found http requests in header \"GET /api/agent-commands/480bf8f3-7dbd-497f-82dd-79caee6db621\"\n Found http requests in header \"GET /api/files/pull?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621\"\n Found http requests in header \"GET /ws/screen?deviceId=480bf8f3-7dbd-497f-82dd-79caee6db621\"","id":"network-62","level":"informative","mitre_attack_id":"T1071.001","name":"Communicates with HTTP webserver (GET/POST requests)","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"ScreenConnect.ClientService.dll\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"ScreenConnect.InstallerActions.dll\"","id":"static-138","level":"informative","mitre_attack_id":"T1012","name":".NET code is able to query registry","origin":"Static Parser","relevance":5,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: MSI7282.tmp]","id":"static-193","level":"informative","mitre_attack_id":"T1489","name":"Calls an API used to change the configuration parameters of a service","origin":"Static Parser","relevance":5,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"System Security","description":"$54","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"fc2898DeriveBytes.CryptDeriveKey is obsolete and is not supported. Use PasswordDeriveBytes.CryptDeriveKey instead.\" (Indicator: \"PasswordDeriveBytes\"; Source: \"00000000-00001144.00000000.119240.00460000.00000004.mdmp, 00000000-00001144.00000001.121162.047E0000.00000004.mdmp, 00000000-00001144.00000001.121162.05520000.00000004.mdmp\")","id":"string-487","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to retrieve key from a password using PBKDF1 algorithm","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\\OID\\ENCODINGTYPE 0\\CERTDLLCREATECERTIFICATECHAINENGINE\\CONFIG\")\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\\OID\\ENCODINGTYPE 0\\CERTDLLCREATECERTIFICATECHAINENGINE\\CONFIG\\DEFAULT\")\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CI\\CONFIG\")\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CI\\CONFIG\\DEFAULT\")","id":"registry-215","level":"informative","mitre_attack_id":"T1497","name":"Observed a high volume of repeated registry API calls (API Hammering)","origin":"Registry Access","relevance":7,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at CFCF0000","id":"module-8","level":"informative","mitre_attack_id":"T1562.001","name":"Loads the AMSI (Antimalware Scan Interface) DLL","origin":"Loaded Module","sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"CryptHashCertificate\" (Indicator: \"CryptHashCertificate\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")\n Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-438","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to perform AES/RC4 encryption (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-423","level":"informative","mitre_attack_id":"T1074.001","name":"Contains ability to create directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$55","id":"registry-130","level":"informative","mitre_attack_id":"T1012","name":"Queries TCP/IP interface details","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Network Related","description":"Short term registered certificate: \"trustconnectsoftware.com\" (89 days old)","id":"certificate-3","level":"informative","mitre_attack_id":"T1583.001","name":"Short-term SSL certificate detected","origin":"Certificate Data","relevance":5,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.bin\")","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"k__BackingField\" (Indicator: \"\"; Source: \"00000000-00001144.00000000.119240.01330000.00000004.mdmp, 00000000-00001144.00000001.121162.02211000.00000020.mdmp\")\n Found string \"k__BackingField\" (Indicator: \"\"; Source: \"00000000-00001144.00000000.119240.01330000.00000004.mdmp, 00000000-00001144.00000001.121162.02211000.00000020.mdmp\")","id":"string-556","level":"informative","mitre_attack_id":"T1056.001","name":"Found strings related to keylogger","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" has a section named \"Section\"\n \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" has a section named \"_RDATA\"","id":"static-60","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file contains unusual section name","origin":"Static Parser","relevance":10,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"}]},{"category":"System Security","description":"\"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","id":"registry-67","level":"informative","mitre_attack_id":"T1543.003","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"Failed to map file. CreateFileW(%s) failed with error %d\" (Indicator: \"CreateFile\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")\n Found reference to API \"Failed to map file. CreateFileMappingW(%s) failed with error %d\" (Indicator: \"CreateFile\"; File: \"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69863f547363e69f5a03363f","report_type":"sandbox"},{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"MSI5B8B.tmp\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 InstallShield self-extracting archive 5 sections\"\n \"MSI7194.tmp\" has type \"data\"\n \"MSI7282.tmp\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"\n \"MSI71A5.tmp\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"","id":"binary-53","level":"informative","mitre_attack_id":"T1105","name":"Drops temp files","origin":"Binary File","relevance":1,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]},{"category":"General","description":"\"ScreenConnect.WindowsFileManager.exe\" has resource with unusual entropy \"RT_ICON:7.775119417889156\"","id":"static-92","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file has unusual entropy resources","origin":"Static Parser","relevance":5,"sources":[{"report_id":"69863569071034fd6e0f7696","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":4,"suspicious_count":0,"total_engines":26},"mitre_attacks":{"total":95},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":251,"malicious_count":2,"suspicious_count":25,"total":278}},"summary":{"score":81,"tags":["new_domain","evasive","malicious"],"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2.exe","file_size":36333296,"file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe"},"hashes":{"imphash":"70d2e884fa127843c5bcbb53da86b6c8","md5":"e725714a55d35a7f9cd93f2358f535b2","sha1":"02856b070b6875226ba08c05169f99d05be5cf94","sha256":"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2","sha512":"07b1f6a0a4e6a71e7bbf0ad1be5feb8e26bce7bd76a2906771e667a99329b2af01129a8311e49cf52e48745b7512953d03acfceba24de916ffcefbfb3fbb5eaf","ssdeep":"393216:nKxapWfkeIqr4SvhZ6sRvI9cR8vq/mQFgeyh0LfHPQu2jYvnUwEbc/81c:b4FHr/vbpvuY7Key+7PJsYPUlbY","ssdeep_chunks":["393216:nKxapWf","393216:KxapWfk","393216:xapWfke","393216:apWfkeI","393216:pWfkeIq","393216:WfkeIqr","393216:fkeIqr4","393216:keIqr4S","393216:eIqr4Sv","393216:Iqr4Svh","393216:qr4SvhZ","393216:r4SvhZ6","393216:4SvhZ6s","393216:SvhZ6sR","393216:vhZ6sRv","393216:hZ6sRvI","393216:Z6sRvI9","393216:6sRvI9c","393216:sRvI9cR","393216:RvI9cR8","393216:vI9cR8v","393216:I9cR8vq","393216:9cR8vq/","393216:cR8vq/m","393216:R8vq/mQ","393216:8vq/mQF","393216:vq/mQFg","393216:q/mQFge","393216:/mQFgey","393216:mQFgeyh","393216:QFgeyh0","393216:Fgeyh0L","393216:geyh0Lf","393216:eyh0LfH","393216:yh0LfHP","393216:h0LfHPQ","393216:0LfHPQu","393216:LfHPQu2","393216:fHPQu2j","393216:HPQu2jY","393216:PQu2jYv","393216:Qu2jYvn","393216:u2jYvnU","393216:2jYvnUw","393216:jYvnUwE","393216:YvnUwEb","393216:vnUwEbc","393216:nUwEbc/","393216:UwEbc/8","393216:wEbc/81","393216:Ebc/81c","786432:nKxapWf","786432:KxapWfk","786432:xapWfke","786432:apWfkeI","786432:pWfkeIq","786432:WfkeIqr","786432:fkeIqr4","786432:keIqr4S","786432:eIqr4Sv","786432:Iqr4Svh","786432:qr4SvhZ","786432:r4SvhZ6","786432:4SvhZ6s","786432:SvhZ6sR","786432:vhZ6sRv","786432:hZ6sRvI","786432:Z6sRvI9","786432:6sRvI9c","786432:sRvI9cR","786432:RvI9cR8","786432:vI9cR8v","786432:I9cR8vq","786432:9cR8vq/","786432:cR8vq/m","786432:R8vq/mQ","786432:8vq/mQF","786432:vq/mQFg","786432:q/mQFge","786432:/mQFgey","786432:mQFgeyh","786432:QFgeyh0","786432:Fgeyh0L","786432:geyh0Lf","786432:eyh0LfH","786432:yh0LfHP","786432:h0LfHPQ","786432:0LfHPQu","786432:LfHPQu2","786432:fHPQu2j","786432:HPQu2jY","786432:PQu2jYv","786432:Qu2jYvn","786432:u2jYvnU","786432:2jYvnUw","786432:jYvnUwE","786432:YvnUwEb","786432:vnUwEbc","786432:nUwEbc/","786432:UwEbc/8","786432:wEbc/81","786432:Ebc/81c","393216:b4FHr/v","393216:4FHr/vb","393216:FHr/vbp","393216:Hr/vbpv","393216:r/vbpvu","393216:/vbpvuY","393216:vbpvuY7","393216:bpvuY7K","393216:pvuY7Ke","393216:vuY7Key","393216:uY7Key+","393216:Y7Key+7","393216:7Key+7P","393216:Key+7PJ","393216:ey+7PJs","393216:y+7PJsY","393216:+7PJsYP","393216:7PJsYPU","393216:PJsYPUl","393216:JsYPUlb","393216:sYPUlbY"]},"submissions":{"first_seen":1770403170000,"last_multi_scan":1771475970000,"last_seen":1771475970000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["69863f547363e69f5a03363f","69863569071034fd6e0f7696"]},"schema_version":"1.0.9","sha256":"8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2","threat_score":81,"unified_at":"2026-09-16T18:16:43.740Z","unified_at_epoch_ms":1789582603740,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious SupportScam_Win32_Screwon_PRP_MTB Sample 8541a01b5cab… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8541a01b5cab…. Malware family: SupportScam_Win32_Screwon_PRP_MTB. Threat score 81/100. 4/26 AV engines flagged this file. 2 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2"}],["$","meta","4",{"property":"og:title","content":"Malicious SupportScam_Win32_Screwon_PRP_MTB Sample 8541a01b5cab… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8541a01b5cab…. Malware family: SupportScam_Win32_Screwon_PRP_MTB. Threat score 81/100. 4/26 AV engines flagged this file. 2 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8541a01b5cabba61606bb35d72edc829092c15cc0c56bf0e6fa9113f03bf68f2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious SupportScam_Win32_Screwon_PRP_MTB Sample 8541a01b5cab… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8541a01b5cab…. Malware family: SupportScam_Win32_Screwon_PRP_MTB. Threat score 81/100. 4/26 AV engines flagged this file. 2 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L56","11",{}]]