26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 880265cb3889… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 880265cb3889…. Malware family: Trojan.Generic. Threat score 100/100. 10/28 AV engines flagged this file. 13 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/880265cb3889dd109ac84a6756367ae56b73b483343a84a42fb35d16c816ec71","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","880265cb3889dd109ac84a6756367ae56b73b483343a84a42fb35d16c816ec71"],"about":{"@type":"SoftwareApplication","name":"trafico.exe","applicationCategory":["peexe","executable"],"identifier":"880265cb3889dd109ac84a6756367ae56b73b483343a84a42fb35d16c816ec71","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1a39,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to "CspParameters" (Indicator: "CspParameters"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp")28:T62a,Assembly shows XOR instruction xor eax ebp in Stream UID: 34941-989-00414E7E Assembly shows XOR instruction xor ecx ebp in Stream UID: 34941-989-00414E7E Assembly shows XOR instruction xor eax ebp in Stream UID: 34941-930-0040D95F Assembly shows XOR instruction xor ecx ebp in Stream UID: 34941-930-0040D95F Assembly shows XOR instruction xor eax ebp in Stream UID: 34941-996-0041515C Assembly shows XOR instruction xor ecx ebp in Stream UID: 34941-996-0041515C Assembly shows XOR instruction xor eax ebp in Stream UID: 34941-931-004157B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 34941-931-004157B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 34941-296-0041458A Assembly shows XOR instruction xor ecx ebp in Stream UID: 34941-296-0041458A Assembly shows XOR instruction xor eax ebp in Stream UID: 34941-849-00412D2A Assembly shows XOR instruction xor ecx ebp in Stream UID: 34941-849-00412D2A Assembly shows XOR instruction xor eax ebp in Stream UID: 34941-936-00418C39 Assembly shows XOR instruction xor ecx ebp in Stream UID: 34941-936-00418C39 Assembly shows XOR instruction xor eax ebp in Stream UID: 34941-991-00414F16 Assembly shows XOR instruction xor ecx ebp in Stream UID: 34941-991-00414F16 Assembly shows XOR instruction xor eax ebp in Stream UID: 34941-117-00412409 Assembly shows XOR instruction xor ecx ebp in Stream UID: 34941-117-00412409 Assembly shows XOR instruction xor eax ebp in Stream UID: 34941-992-00414F8A Assembly shows XOR instruction xor ecx ebp in Stream UID: 34941-992-00414F8A29:T456,Found string "b__754_0" (Indicator: "DecryptRSA"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "DecryptRSA" (Indicator: "DecryptRSA"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "EncryptRSA" (Indicator: "EncryptRSA"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "description="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp")2a:T494,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to decode base64 data Matched sigs: Contains reference to cryptographic keys Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly]2b:Tef2,"88026.Backdoor.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000002ab32fced32746735026ef00687d1176f0f4ef00e0564673265088bdfeffffff0cf4ef0092424573b0f3ef0000007675a8f4ef00ab424573e0dfb07308000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000038f4ef00000000000800000000000000000000000000000000000000000000000000767502b32fce0000000078f4ef006992b976ffffffff3400000038f4ef00080000000000000000007675a8f4ef002794b97640f4ef000b0000000000000090f4ef00 (UID: 00000000-00001172) "88026.Backdoor.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000002b03f0ae29030000000000000000371d257b0000000000000800610000000000b700780cb700c80cb700f0ae29031f00000028f3ef00050000009e291b7728102b030000000038000000340000000000290370f3ef000000000007000000000000000000000000000000d007b7004000000000000000050000000000b700000800006100ef0000a846730b000000c00e2b0300af29030500000000000000200000000000b700d801b7007c0cb70000000000780cb70054f3ef0068f3ef0050f51a7728102b03d0f3ef001cf4ef0000002903c8ae290350f51a7728102b0300007672feffffffe00cb700f0ae290300000000000000000000767270f3ef00 (UID: 00000000-00001172) "88026.Backdoor.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040d6d604e4d5d604226efc7300000303000000002d6efc732c488ec02d000000ecb72b7468d6d6040000b70008ec300390652f030c00000080000000a8d5d6040000b7002cd6d60470c8fd7330ec5ab0feffffff2d000000d0cc3a7427000000fcd5d604856afe731c2303743cd6d604f85ffe7308000000bb69fd73b269fd73f44b8ec02d000000ecb72b7427000000d0cc3a7410d6d6042d000000d0cc3a742700000040d6d604856afe731c23037488d6d6047e8a3974ee8c3974738a3974dfd13b9b2d000000ecb72b7427000000d0cc3a74ac2c0303402c0303dfd13b9b50d6d604fc5277743cd7d604e08439746ff698ebfeffffff738a3974 (UID: 00000000-00001172) "88026.Backdoor.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000e36e187de36e00000000d0a9e2730000db739011dc73e0393003d8ae2a03a81c300308ecd604feffffffb0eed604506a1e7770accb21feffffffc8ecd604eaa91a77e039300300000000a81c3003a11400000a000b00b297e36e5c76e36e6876e36ea81c300308fe3003140000000000000000000000e0393003f0ecd604cc2d1f77a81c300300000000b41c300300000000f800dc6e00000000cc0d24385ce81d7768401c770403000019000000110000001000000030b4290328edd6048d9aa273c8b029039c8b30030000000048edd60404b029039c8b300360edd6040000dc6efeffffff0400000020afa27300000000000000000000dc6e50edd604 (UID: 00000000-00001172)2c:T1dd6,"88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000002812fd04000029035f0001001800000000000000000000000300000002000000000029030c00000000000000d8f03d0bc4f03d0bee131b772812fd04ee131b7700000000000000000c000000db8a91c95c050d74dcf03d0b2823eb7100002903000000000c00000020020d05e8f03d0b2f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000002903000000001800000000000000000000000300000002000000000029030c00000000000000bb389623c4f0d604ee131b7700000000ee131b7700000000000000000c000000ffff916e1c713603dcf0d6042823eb7100002903000000000c000000b0148f6ee8f0d6042f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161b770c000000000000000000000000002903e0f1d6041800000000000000000000000300000002000000000029030c0000000000000084f1d60488f1d604ee131b7700000000ee131b7700000000000000000c00000024bf96bda0f1d6042823eb7100002903000000000c00000030a59c6eacf1d6042f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000002812fd0400002903a38640731800000000000000000000000300000002000000000029030c0000000000000020000000f4f1510bee131b772812fd04ee131b7700000000000000000c000000906f3503006f35030cf2510b2823eb7100002903000000000c00000020c20d0518f2510b2f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161b770c000000000000000000000000002903100000001800000000000000000000000300000002000000000029030c00000000000000e4f0d604d0f0d604ee131b7700000000ee131b7700000000000000000c000000ffff916ee8f0d6042823eb7100002903000000000c000000b0148f6ef4f0d6042f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000002812fd0400002903a38640731800000000000000000000000300000002000000000029030c000000000000002000000064f4550bee131b772812fd04ee131b7700000000000000000c00000088723503007235037cf4550b2823eb7100002903000000000c0000002042100588f4550b2f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161b770c000000000000000000000000002903100000001800000000000000000000000300000002000000000029030c000000000000009cf0d60488f0d604ee131b7700000000ee131b7700000000000000000c000000ffff916ea0f0d6042823eb7100002903000000000c000000b0148f6eacf0d6042f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000002903010000001800000000000000000000000300000002000000000029030c00000000000000feffffff64f1d604ee131b7700000000ee131b7700000000000000000c00000024bf96bd70f1d6047cf1d6042823eb7100002903000000000c00000030a59c6e88f1d6042f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000002812fd0400002903a38640731800000000000000000000000300000002000000000029030c000000000000002000000064f4550bee131b772812fd04ee131b7700000000000000000c00000010d1640a00d1640a7cf4550b2823eb7100002903000000000c0000002062120588f4550b2f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161b770c000000000000000000000000002903100000001800000000000000000000000300000002000000000029030c00000000000000bcf0d604a8f0d604ee131b7700000000ee131b7700000000000000000c000000ffff916ec0f0d6042823eb7100002903000000000c000000b0148f6eccf0d6042f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161b770c000000000000000000000000002903b8f1d6041800000000000000000000000300000002000000000029030c000000000000005cf1d60460f1d604ee131b7700000000ee131b7700000000000000000c00000024bf96bd78f1d6042823eb7100002903000000000c00000030a59c6e84f1d6042f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000002812fd0400002903a38640731800000000000000000000000300000002000000000029030c000000000000002000000034ed550bee131b772812fd04ee131b7700000000000000000c00000030cf640a00cf640a4ced550b2823eb7100002903000000000c00000020a2120558ed550b2f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000002903000000001800000000000000000000000300000002000000000029030c000000000000006b38962394f0d604ee131b7700000000ee131b7700000000000000000c000000ffff916e2cd2640aacf0d6042823eb7100002903000000000c000000b0148f6eb8f0d6042f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161b770c000000000000000000000000002903b0f1d6041800000000000000000000000300000002000000000029030c0000000000000054f1d60458f1d604ee131b7700000000ee131b7700000000000000000c00000024bf96bd70f1d6042823eb7100002903000000000c00000030a59c6e7cf1d6042f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161b770c000000000000002812fd0400002903000000001800000000000000000000000300000002000000000029030c000000000000003c373f73c0f1ca0cee131b772812fd04ee131b7700000000000000000c00000098c9670ad8f1ca0c2823eb7100002903000000000c00000080f83405e4f1ca0c2f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161b770c000000000000000000000000002903200000001800000000000000000000000300000002000000000029030c00000000000000acf0d60498f0d604ee131b7700000000ee131b7700000000000000000c000000ffff916eb0f0d6042823eb7100002903000000000c000000b0148f6ebcf0d6042f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161b770c000000000000000000000000002903a8f1d6041800000000000000000000000300000002000000000029030c000000000000004cf1d60450f1d604ee131b7700000000ee131b7700000000000000000c00000024bf96bd68f1d6042823eb7100002903000000000c00000030a59c6e74f1d6042f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161b770c000000000000002812fd0400002903000000001800000000000000000000000300000002000000000029030c000000000000003c373f73d0efca0cee131b772812fd04ee131b7700000000000000000c00000050cb670ae8efca0c2823eb7100002903000000000c00000080183505f4efca0c2f999c6e0c000000 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000161b770c000000000000002812fd0400002903000000001800000000000000000000000300000002000000000029030c000000000000003c373f7360f0ca0cee131b772812fd04ee131b7700000000000000000c00000000cb670a78f0ca0c2823eb7100002903000000000c0000008058350584f0ca0c2f999c6e0c000000 (UID: 00000000-00001172)2d:T4c3,"88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")2e:Td65,"88026.Backdoor.exe" queries volume information of "C:\88026.Backdoor.exe" at 00000000-00001172-00000C15-41281353 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00001172-00000C15-41477588 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00001172-00000C15-41646409 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00001172-00000C15-42519196 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00001172-00000C15-42543151 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll" at 00000000-00001172-00000C15-42607837 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll" at 00000000-00001172-00000C15-42784993 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00001172-00000C15-42971575 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001172-00000C15-43219295 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001172-00000C15-43230468 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001172-00000C15-43230603 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00001172-00000C15-45284028 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll" at 00000000-00001172-00000C15-48488413 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll" at 00000000-00001172-00000C15-49023889 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00001172-00000C15-49514570 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00001172-00000C15-49543264 "88026.Backdoor.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00001172-00000C15-499402382f:T80f,"88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYVERSION") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYVERSION") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYVERSION") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "88026.Backdoor.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYVERSION")30:T2431,"88026.Backdoor.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\aspnet_rc.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\aspnet_rc.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_rc.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\webengine4.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\webengine4.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter webengine4.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\crypt32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter C:\rstrtmgr.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001172)31:T8b56,"88026.Backdoor.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter InitializeLibrary (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost_RetAddr (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter PerfCounterInitialize (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter MgdGetIISVersionInformation (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetDirMonConfiguration (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ZeroMemory (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter ZeroMemoryA (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CryptUnprotectDataW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter BCryptImportKey (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetClassLong (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter SetClassLongW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00001172) "88026.Backdoor.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00001172)32:T54b0,Found reference to API (Indicator: "EncodePointer"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "DecodePointer"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "FlsFree"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "FlsSetValue"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "FlsGetValue"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "FlsAlloc"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "MessageBoxA"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "Sleep"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "CreateThread"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "lstrlenW"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "VirtualProtect"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetProcAddress"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "CreateEventW"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "FreeConsole"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetLastError"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "HeapFree"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "HeapAlloc"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "RtlUnwind"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "RaiseException"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "TerminateProcess"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetCPInfo"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "LCMapStringA"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "LCMapStringW"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "HeapCreate"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "VirtualFree"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "ExitProcess"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "WriteFile"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetStdHandle"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "TlsGetValue"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "TlsAlloc"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "TlsSetValue"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "TlsFree"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "SetLastError"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "SetHandleCount"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetFileType"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetTickCount"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "ReadFile"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "SetFilePointer"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "CloseHandle"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "HeapSize"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetACP"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetOEMCP"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "IsValidLocale"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetStringTypeA"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "SetStdHandle"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "CreateFileA"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "88026.Backdoor.exe") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp, 00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp, 00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp, 00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp, 00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesA"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API (Indicator: "CreateService"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API (Indicator: "PathCombine"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API (Indicator: "LoadCursor"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp")33:T62f,"%APPDATA%\Opera Software\*" in Source: 00000000-00001172-00000C28-21448547406 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00001172-00000C28-21487091168 "Software\Valve\Steam" in Source: 00000000-00001172.00000000.66960.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001172.00000000.66960.04FD0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001172.00000000.66960.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001172.00000000.66960.04FD0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00001172.00000000.66960.04FD0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00001172.00000000.66960.04FD0000.00000004.mdmp "SOFTWARE\WOW6432Node\Clients\StartMenuInternet" in Source: 00000000-00001172.00000000.66960.04FD0000.00000004.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00001172.00000000.66960.04FD0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001172.00000000.66960.04FD0000.00000004.mdmp "-%USERPROFILE%\AppData\Roaming\Opera Software\F" in Source: 00000000-00001172.00000000.66960.04FD0000.00000004.mdmp "A%USERPROFILE%\AppData\Local\BraveSoftware\Brave-Browser\User DataF" in Source: 00000000-00001172.00000000.66960.04FD0000.00000004.mdmp "Read7HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa" in Source: 00000000-00001172.00000000.66960.09E60000.00000004.mdmp34:T954,"88026.Backdoor.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "88026.Backdoor.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "88026.Backdoor.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "88026.Backdoor.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "88026.Backdoor.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "88026.Backdoor.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "88026.Backdoor.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "88026.Backdoor.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "88026.Backdoor.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "88026.Backdoor.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "88026.Backdoor.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "88026.Backdoor.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "88026.Backdoor.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll" - [base:0; Status:c0000135] "88026.Backdoor.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\crypt32.dll" - [base:0; Status:c0000135] "88026.Backdoor.exe" failed to load missing module "C:\rstrtmgr.dll" - [base:0; Status:c0000135]35:T1ebc,"88026.Backdoor.exe" loaded module "KERNEL32" at base 76fc0000 "88026.Backdoor.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76a90000 "88026.Backdoor.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76a90000 "88026.Backdoor.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76a90000 "88026.Backdoor.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 768b0000 "88026.Backdoor.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76a90000 "88026.Backdoor.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76a90000 "88026.Backdoor.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76a90000 "88026.Backdoor.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733f0000 "88026.Backdoor.exe" loaded module "MSCOREE.DLL" at base 72760000 "88026.Backdoor.exe" loaded module "ADVAPI32.DLL" at base 763f0000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 726d0000 "88026.Backdoor.exe" loaded module "SHLWAPI.DLL" at base 75900000 "88026.Backdoor.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 757f0000 "88026.Backdoor.exe" loaded module "VERSION.DLL" at base 737e0000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71f20000 "88026.Backdoor.exe" loaded module "USER32.DLL" at base 73db0000 "88026.Backdoor.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76a90000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "88026.Backdoor.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74040000 "88026.Backdoor.exe" loaded module "PSAPI.DLL" at base 769a0000 "88026.Backdoor.exe" loaded module "KERNEL32.DLL" at base 76fc0000 "88026.Backdoor.exe" loaded module "RPCRT4.DLL" at base 76db0000 "88026.Backdoor.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70a40000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "88026.Backdoor.exe" loaded module "OLE32.DLL" at base 73cb0000 "88026.Backdoor.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73530000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "88026.Backdoor.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74040000 "88026.Backdoor.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76a90000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 709b0000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "88026.Backdoor.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6ff50000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "88026.Backdoor.exe" loaded module "UXTHEME.DLL" at base 73530000 "88026.Backdoor.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f730000 "88026.Backdoor.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f620000 "88026.Backdoor.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6eea0000 "88026.Backdoor.exe" loaded module "NTDLL.DLL" at base 77170000 "88026.Backdoor.exe" loaded module "SHELL32.DLL" at base 74290000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "88026.Backdoor.exe" loaded module "BCRYPT.DLL" at base 72820000 "88026.Backdoor.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6ee50000 "88026.Backdoor.exe" loaded module "IMM32.DLL" at base 768b0000 "88026.Backdoor.exe" loaded module "COMCTL32.DLL" at base 6edc0000 "88026.Backdoor.exe" loaded module "GDI32.DLL" at base 75760000 "88026.Backdoor.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 73c50000 "88026.Backdoor.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 6eae0000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6ea90000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "88026.Backdoor.exe" loaded module "WS2_32.DLL" at base 75950000 "88026.Backdoor.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73490000 "88026.Backdoor.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76a90000 "88026.Backdoor.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6ea70000 "88026.Backdoor.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6e9f0000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6e9c0000 "88026.Backdoor.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6e9b0000 "88026.Backdoor.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6e8f0000 "88026.Backdoor.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76a90000 "88026.Backdoor.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76a90000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "88026.Backdoor.exe" loaded module "OLEAUT32.DLL" at base 75800000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "88026.Backdoor.exe" loaded module "SSPICLI.DLL" at base 73ab0000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "88026.Backdoor.exe" loaded module "SECUR32.DLL" at base 6e8e0000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WEBENGINE4.DLL" at base 6e850000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WEBENGINE4.DLL" at base 6e850000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.WEB\V4.0_4.0.0.0__B03F5F7F11D50A3A\WEBENGINE4.DLL" at base 0 "88026.Backdoor.exe" loaded module "WEBENGINE4.DLL" at base 6e850000 "88026.Backdoor.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.SECURITY\V4.0_4.0.0.0__B03F5F7F11D50A3A\CRYPT32.DLL" at base 0 "88026.Backdoor.exe" loaded module "CRYPT32.DLL" at base 755d0000 "88026.Backdoor.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 72820000 "88026.Backdoor.exe" loaded module "C:\RSTRTMGR.DLL" at base 0 "88026.Backdoor.exe" loaded module "RSTRTMGR.DLL" at base 6e7e0000 "88026.Backdoor.exe" loaded module "GDIPLUS.DLL" at base 737f0000 "88026.Backdoor.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 737f0000 "88026.Backdoor.exe" loaded module "WINDOWSCODECS.DLL" at base 72b5000036:T1222,Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: 88026.Backdoor.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: 88026.Backdoor.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll",0" [Source: 88026.Backdoor.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",0" [Source: 88026.Backdoor.exe.log] Observed system executable string:"3,"System.Runtime.Serialization Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization.ni.dll",0" [Source: 88026.Backdoor.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001172-00000C25-40762494] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001172-00000C25-41029173] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001172-00000C25-41092106] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001172-00000C25-41146709] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001172-00000C25-41246627] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001172-00000C25-41282197] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001172-00000C25-41314703] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001172-00000C25-41381262] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00001172-00000C25-41535282] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001172-00000C25-41598391] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00001172-00000C25-41725170] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001172-00000C25-41842531] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00001172-00000C25-41866118] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00001172-00000C25-41924121] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001172-00000C25-42220311] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" [Source: 00000000-00001172-00000C25-43239543] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00001172-00000C25-43758314] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00001172-00000C25-45387886] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001172-00000C25-45505417] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001172-00000C25-45660183]37:T671,The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB" (SHA1: E5:7C:E0:1F:6A:5E:1D:4C:52:2B:C6:84:88:AF:53:D9:BA:D1:3A:B7; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: D1:EB:23:A4:6D:17:D6:8F:D9:25:64:C2:F1:F1:60:17:64:D8:E3:49; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB" (SHA1: 0B:C5:E7:67:73:D2:E4:4F:C9:90:3D:4D:FE:FE:45:15:53:BB:EC:4A; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B6:C8:AF:83:4D:4E:53:B6:73:C7:68:72:AA:8C:95:0C:7C:54:DF:5F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA, O="DigiCert Inc.", C=US" (SHA1: F3:87:22:4D:86:33:82:92:35:A9:94:BC:BD:8F:96:E9:FE:1C:7C:73; see report for more information)38:T69b,"88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT"; Key: ""; Value: "")39:T78a,"88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{027947E1-D731-11CE-A357-000000000001}\PROXYSTUBCLSID32"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCSERVER32"; Key: ""; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "")3a:Tb2d,"88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\MSCOREE.DLL" "88026.Backdoor.exe" trying to access non-existent file "C:\mscoree.dll" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "88026.Backdoor.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "88026.Backdoor.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "88026.Backdoor.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "88026.Backdoor.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\RPCSS.DLL" "88026.Backdoor.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "88026.Backdoor.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "88026.Backdoor.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll"3b:T902,"88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "88026.Backdoor.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\88026.BACKDOOR.EXE.CONFIG" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "88026.Backdoor.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\88026.BACKDOOR.EXE.LOG" "88026.Backdoor.exe" trying to access non-existent file "C:\88026.Backdoor.exe.config" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\RATAFIA" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\88026.BACKDOOR.INI" "88026.Backdoor.exe" trying to access non-existent file "C:\88026.Backdoor.INI" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "88026.Backdoor.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "88026.Backdoor.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "88026.Backdoor.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI"3c:T3a77,Heuristic match: "PV***i\.iS" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "tes.Se" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "el.Cc" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#WithComments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/TR/1999/REC-xpath-19991116" Pattern match: "http://www.w3.org/TR/1999/REC-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#XML" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/XML/1998/namespace" Pattern match: "http://schemas.microsoft.com/.NetConfiguration/v2.0" Pattern match: "system.web/anonymousIdentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browserCaps" Pattern match: "system.web/clientTarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customErrors" Pattern match: "system.web/deployment" Pattern match: "system.web/deviceFilters" Pattern match: "system.web/fullTrustAssemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthMonitoring" Pattern match: "system.web/hostingEnvironment" Pattern match: "system.web/httpCookies" Pattern match: "system.web/httpHandlers" Pattern match: "system.web/httpModules" Pattern match: "system.web/httpRuntime" Pattern match: "system.web/identity" Pattern match: "system.web/machineKey" Pattern match: "system.web/membership" Pattern match: "system.web/mobileControls" Pattern match: "system.web/pages" Pattern match: "system.web/partialTrustVisibleAssemblies" Pattern match: "system.web/processModel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/roleManager" Pattern match: "system.web/securityPolicy" Pattern match: "system.web/sessionPageState" Pattern match: "system.web/sessionState" Pattern match: "system.web/siteMap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlMappings" Pattern match: "system.web/webControls" Pattern match: "system.web/webParts" Pattern match: "system.web/webServices" Pattern match: "system.web/xhtmlConformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputCache" Pattern match: "system.web/caching/outputCacheSettings" Pattern match: "system.web/caching/sqlCacheDependency" Pattern match: "http://tempuri.org/" Pattern match: "http://schemas.xmlsoap.org/soap/actor/next" Pattern match: "http://schemas.xmlsoap.org/soap/envelope/" Pattern match: "http://www.w3.org/2003/05/soap-envelope/role/ultimateReceiver" Pattern match: "http://www.w3.org/2003/05/soap-envelope/role/next" Pattern match: "http://www.w3.org/2003/05/soap-envelope" Pattern match: "http://schemas.microsoft.com/ws/2005/05/envelope/none" Pattern match: "http://schemas.microsoft.com/ws/2005/05/addressing/none" Pattern match: "http://www.w3.org/2005/08/addressing" Pattern match: "http://www.w3.org/2005/08/addressing/anonymous" Pattern match: "http://www.w3.org/2005/08/addressing/none" Pattern match: "http://www.w3.org/2005/08/addressing/fault" Pattern match: "http://www.w3.org/2005/08/addressing/soap/fault" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/fault" Pattern match: "http://www.w3.org/2005/08/addressing/reply" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm" Pattern match: "http://schemas.microsoft.com/ws/2006/05/rm" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty" Pattern match: "http://schemas.microsoft.com/2005/12/ServiceModel/Addressing/Anonymous" Pattern match: "http://schemas.microsoft.com/2005/12/ServiceModel/Addressing/None" Pattern match: "http://schemas.microsoft.com/2011/02/session/onopen" Pattern match: "http://tempuri.org/Contract/" Pattern match: "http://tempuri.org/Contract/MSValue1" Pattern match: "http://tempuri.org/Contract/MSValue1Response" Pattern match: "http://tempuri.org/Contract/MSValue2" Pattern match: "http://tempuri.org/Contract/MSValue2Response" Pattern match: "http://tempuri.org/Contract/MSValue3" Pattern match: "http://tempuri.org/Contract/MSValue3Response" Pattern match: "http://schemas.microsoft.com/2003/10/Serialization/Arrays" Pattern match: "http://schemas.microsoft.com/2003/10/Serialization/" Pattern match: "http://schemas.microsoft.com/net/2005/12/windowscommunicationfoundation/dispatcher/fault" Pattern match: "http://schemas.xmlsoap.org/ws/2006/02/addressingidentity" Pattern match: "http://www.w3.org/2001/XMLSchema" Pattern match: "http://microsoft.com/wsdl/types/" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/sc" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret" Pattern match: "http://schemas.microsoft.com/ws/2006/02/transactions" Pattern match: "http://schemas.xmlsoap.org/ws/2004/06/addressingex" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/sc" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/sc/dk" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/sc/sct" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" Pattern match: "http://www.w3.org/2001/04/xmlenc#rsa-1_5" Pattern match: "http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap" Pattern match: "http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap" Pattern match: "http://schemas.microsoft.com/ws/2006/05/security" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text" Pattern match: "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentifier" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/spnego" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/trust" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey" Pattern match: "http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey" Pattern match: "http://schemas.microsoft.com/net/2004/07/secext/WS-SPNego" Pattern match: "http://schemas.microsoft.com/net/2004/07/secext/TLSNego" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/Issue" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/Renew" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel" Pattern match: "http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey" Pattern match: "http://schemas.microsoft.com/ws/2005/02/duplex" Pattern match: "http://www.w3.org/2001/04/xmlenc#Element" Pattern match: "http://www.w3.org/2001/04/xmlenc#Content" Pattern match: "http://schemas.microsoft.com/ws/2006/02/tx/oletx" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wscoor" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay" Pattern match: "http://schemas.xmlsoap.org/ws/2004/10/wsat/fault" Pattern match: "http://schemas.microsoft.com/2004/09/ServiceModel/Diagnostics" Pattern match: "http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1" Pattern match: "http://schemas.xmlsoap.org/ws/2002/12/policy" Pattern match: "http://schemas.microsoft.com/net/2006/05/peer/HopCount" Pattern match: "http://schemas.microsoft.com/net/2006/05/peer" Pattern match: "http://schemas.microsoft.com/ws/2005/05/routing" Heuristic match: "Unsupported Type: {0}. Please let us know about this type and we will support it: sales@zzzprojects.com" Heuristic match: "FileStream.IO" Pattern match: "https://api.ip.sb/ip" Heuristic match: "ag.gP" Heuristic match: "0g.gP"3d:T9fc,"88026.Backdoor.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00001172) "88026.Backdoor.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001172)3e:T14e4,Found string "DecodeBase64" (Indicator: "base64"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "EncodeBase64" (Indicator: "base64"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "IsBase64" (Indicator: "base64"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "EncryptRSA" (Indicator: "encryptrsa"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "base64str" (Indicator: "base64"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "Base64FormattingOptions" (Indicator: "base64"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "ToBase64CharArray" (Indicator: "base64"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001172.00000000.66960.03290000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001172.00000000.66960.03290000.00000004.mdmp, 00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "AEs`" (Indicator: "aes"; Source: "00000000-00001172.00000000.66960.034C0000.00000004.mdmp") Found string "AEs@" (Indicator: "aes"; Source: "00000000-00001172.00000000.66960.034C0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp")3f:T60e,Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001172.00000000.66960.03290000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001172.00000000.66960.03290000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001172.00000000.66960.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001172.00000000.66960.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001172.00000000.66960.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001172.00000000.66960.03290000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001172.00000000.66960.03290000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001172.00000000.66960.03290000.00000004.mdmp")40:T723,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "88026.Backdoor.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "88026.Backdoor.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "88026.Backdoor.exe") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "88026.Backdoor.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "88026.Backdoor.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "88026.Backdoor.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp, 00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001172.00000000.66960.0041F000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp")41:T49b,Found string "ZIndicates if the text in the edit control should appear as the default password character." (Indicator: "password"; Source: "00000000-00001172.00000000.66960.00425000.00000004.mdmp, 00000000-00001172.00000000.66960.03042000.00000020.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp") Found string "binance_secretF" (Indicator: "secret"; Source: "00000000-00001172.00000000.66960.04FD0000.00000004.mdmp")42:T74a,"88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "88026.Backdoor.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")43:T634,"88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-40041915 [PID: 1172] "88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-40043428 [PID: 1172] "88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-42115560 [PID: 1172] "88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-42117032 [PID: 1172] "88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-42251657 [PID: 1172] "88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-42253076 [PID: 1172] "88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-45776539 [PID: 1172] "88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-45777919 [PID: 1172] "88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-46042560 [PID: 1172] "88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-46045863 [PID: 1172] "88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-49989673 [PID: 1172] "88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-49991041 [PID: 1172] "88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-50851713 [PID: 1172] "88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-50853240 [PID: 1172] "88026.Backdoor.exe" queried SystemProcessInformation at 00000000-00001172-00000C13-51353239 [PID: 1172]44:T1cb3,"88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\ELEMENTS BROWSER\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\UCOZMEDIA\URAN\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\LIEBAO\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\AMIGO\USER\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAXTHON3\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\K-MELON\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\URAN\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHROMODO\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAIL.RU\ATOM\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CRYPTOTAB BROWSER\USER DATA" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\ODBFPEEIHDKBIHMOPKBJMOONFANLBFCL" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FHILAHEIMGLIGNDDKJGOFKCBGEKHENBH" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FNJHMKHHMKBJKKABNDCNNOGAGOGBNEEC" "88026.Backdoor.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AIIFBNBFOBPMEEKIPHEEIJIMDPNLPGPP"45:T1abe,88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID related to Nifty Wallet 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD related to Coinbase Wallet 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC related to EQUA Wallet 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE related to Jaxx Liberty 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ related to iWallet 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH related to Wombat 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM related to MEW CX 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ related to GuildWallet 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG related to Saturn Wallet 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FNJHMKHHMKBJKKABNDCNNOGAGOGBNEEC related to Ronin Wallet 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AIIFBNBFOBPMEEKIPHEEIJIMDPNLPGPP related to Terra Station 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet 88026.Backdoor.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KPFOPKELMAPCOIPEMFENDMDCGHNEGIMN related to Liquality Wallet 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID related to Nifty Wallet 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD related to Coinbase Wallet 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC related to EQUA Wallet 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE related to Jaxx Liberty 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ related to iWallet 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH related to Wombat 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM related to MEW CX 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ related to GuildWallet 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG related to Saturn Wallet 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FNJHMKHHMKBJKKABNDCNNOGAGOGBNEEC related to Ronin Wallet 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AIIFBNBFOBPMEEKIPHEEIJIMDPNLPGPP related to Terra Station 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet 88026.Backdoor.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\KPFOPKELMAPCOIPEMFENDMDCGHNEGIMN related to Liquality Wallet46:T5af,Found reference to API "IOpenServiceManager" (Indicator: "OpenService"; Source: "00000000-00004036.00000001.67121.694D1000.00000020.mdmp") Found reference to API "IOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00004036.00000001.67121.694D1000.00000020.mdmp") Found reference to API "IOpenServiceActivityManager" (Indicator: "OpenService"; Source: "00000000-00004036.00000001.67121.694D1000.00000020.mdmp") Found reference to API "IOpenServiceActivityOutputContext" (Indicator: "OpenService"; Source: "00000000-00004036.00000001.67121.694D1000.00000020.mdmp") Found reference to API "IOpenServiceActivityInput" (Indicator: "OpenService"; Source: "00000000-00004036.00000001.67121.694D1000.00000020.mdmp") Found reference to API "IOpenService" (Indicator: "OpenService"; Source: "00000000-00004036.00000001.67121.694D1000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00004036.00000001.67121.694D1000.00000020.mdmp") Found reference to API "IOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00004036.00000001.67121.694D1000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00004036.00000001.67121.694D1000.00000020.mdmp") Found reference to API "IOpenServiceManagerInternal" (Indicator: "OpenService"; Source: "00000000-00004036.00000001.67121.694D1000.00000020.mdmp")47:T502,Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_trafico") Found string "" (Indicator: "twitter"; File: "urlref_httpgo.microsoft.comfwlinkprd_11324_pver_4.5_sbp_AppLaunch2_plcid_0x409_o1_SHIM_NOVERSION_FOUND_version_null_processName_trafico") Found string "" (Indicator: "github.com")49:T64d,Found string "" (Indicator: "text/javascript"; File: "ELTF0B3D.htm") Found string "" (Indicator: "text/javascript"; File: "ELTF0B3D.htm") Found string "" (Indicator: "text/javascript"; File: "ELTF0B3D.htm") Found string "" (Indicator: "text/javascript"; File: "ELTF0B3D.htm") Found string "