24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 74:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ad,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.ClipBanker Sample 8817cbb6de14… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8817cbb6de14…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 18/28 AV engines flagged this file. 19 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","keywords":["Malicious","IL:Trojan.ClipBanker","malware analysis","sandbox report","threat intelligence","8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c"],"about":{"@type":"SoftwareApplication","name":"brandrock.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.ClipBanker","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":19,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T43a,"Broom.exe" called "FindResourceW" with parameter "789" - (UID: 00000000-00005776) "Broom.exe" called "FindResourceW" with parameter "2" - (UID: 00000000-00005776) "Broom.exe" called "FindResourceW" with parameter "9" - (UID: 00000000-00005776) "Broom.exe" called "FindResourceW" with parameter "3" - (UID: 00000000-00005776) "Broom.exe" called "FindResourceW" with parameter "19" - (UID: 00000000-00005776) "Broom.exe" called "FindResourceW" with parameter "1001" - (UID: 00000000-00005776) "Broom.exe" called "FindResourceW" with parameter "2105" - (UID: 00000000-00005776) "Broom.exe" called "FindResourceW" with parameter "10" - (UID: 00000000-00005776) "Broom.exe" called "FindResourceW" with parameter "20" - (UID: 00000000-00005776) "Broom.exe" called "FindResourceW" with parameter "2107" - (UID: 00000000-00005776) "Broom.exe" called "FindResourceW" with parameter "8" - (UID: 00000000-00005776) "Broom.exe" called "FindResourceW" with parameter "18" - (UID: 00000000-00005776) "Broom.exe" called "FindResourceW" with parameter "2104" - (UID: 00000000-00005776)26:Ta8f,"InstallSetup5.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477344'}" (UID: 00000000-00005788) "InstallSetup5.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477264'}" (UID: 00000000-00005788) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866360'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864344'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866376'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864360'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866392'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864376'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866408'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864392'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866440'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864424'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866424'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864408'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866456'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864872'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864840'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '1965555712', 'hResInfo': '2426352'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '1876951040', 'hResInfo': '1876959360'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '1653211138', 'hResInfo': '1653340016'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '1653211138', 'hResInfo': '1653301616'}" (UID: 00000000-00005776) "Broom.exe" called "LoadResource with parameter {'hModule': '1673527298', 'hResInfo': '1673656192'}" (UID: 00000000-00005776)27:T1284,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "result == ((((DWORD )0x00000000L) ) + 0 ) && L"WaitForSingleObject failed"" (Indicator: "WaitForSingleObject"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp, 00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70B44000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "(BOOL)g_pfnGetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CreateTimerQueueTimer(&m_hTimerQueueHandle, nullptr, PeriodicTimer::TimerFired, this, period, period, 0x00000000)" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70B44000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70B44000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp")28:T7d3,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "FreeLibraryAnd" (Indicator: "FreeLibrary"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp")29:T639,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/w" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/w" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp")2a:T4ca,Found reference to ".?AVSHA512@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00005776.00000001.82813.70562000.00000004.mdmp") Found reference to ".?AV?$IteratedHashWithStaticTransform@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@$0EA@VSHA512@2@$0EA@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00005776.00000001.82813.70562000.00000004.mdmp") Found reference to ".?AV?$ClonableImpl@VSHA512@CryptoPP@@V?$AlgorithmImpl@V?$IteratedHash@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@VHashTransformation@2@@CryptoPP@@VSHA512@2@@2@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00005776.00000001.82813.70562000.00000004.mdmp") Found reference to ".?AV?$AlgorithmImpl@V?$IteratedHash@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@VHashTransformation@2@@CryptoPP@@VSHA512@2@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00005776.00000001.82813.70562000.00000004.mdmp") Found reference to ".?AV?$HMAC@VSHA512@CryptoPP@@@CryptoPP@@" (Indicator: "HMAC"; Source: "00000000-00005776.00000001.82813.70562000.00000004.mdmp") Found reference to ".?AV?$HMAC@VSHA512@CryptoPP@@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00005776.00000001.82813.70562000.00000004.mdmp")2b:Tf2c,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}\") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS")2c:T4b7,Found api reference "CryptAcquireContextW(&hProv, 0, 0, 1, 0xF0000000)" (Indicator: "CryptAcquireContextW"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found api reference "CryptImportKey(hProv, pBlob, cbBlob, 0, 0, &hKey)" (Indicator: "CryptImportKey"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found api reference "CryptCreateHash(hProv, ((4 << 13) | (0) | 9), hKey, 0, &hHash)" (Indicator: "CryptCreateHash"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found api reference "CryptSetHashParam(hHash, 0x0005, pHmacInfo, 0)" (Indicator: "CryptSetHashParam"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found api reference "CryptHashData(hHash, pbBuffer, cbBuffer, 0)" (Indicator: "CryptHashData"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found api reference "CryptHashData(hHash, bHmacPadding, cbPadding, 0)" (Indicator: "CryptHashData"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found api reference "CryptGetHashParam(hHash, 0x0002, pHash, &dwHmacLen, 0)" (Indicator: "CryptGetHashParam"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp")2d:Ta6f8,Found XOR loop in file "Broom.exe" at offset 183152; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 1398424; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 2277228; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 3174453; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 3981781; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4215979; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4245459; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4251701; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4260243; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4264477; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4265025; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4271407; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4271957; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4273515; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4274021; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4279917; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4280775; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4284139; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4288461; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4290757; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4291873; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4297089; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4300237; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4304883; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4313819; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4319369; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4320045; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4322943; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4323589; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4324945; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4333207; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4338377; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4352667; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4356527; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4357111; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4359663; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4360203; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4369085; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4374163; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4376541; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4377281; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4380581; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4381685; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4382305; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4386127; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4395379; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4398571; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4404639; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4412133; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4425135; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4427849; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4435905; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4440201; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4442039; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4445249; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4448235; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4450563; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4453889; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4457403; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4460219; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4460969; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4467047; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4471467; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4474225; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4482825; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4489837; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4491907; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4498605; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4503451; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4505491; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4507535; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4509567; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4511595; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4513603; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4515581; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4520079; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 4521503; code bytes = 30d0 Found XOR loop in file "Broom.exe" at offset 207330; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 751110; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 751176; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 751734; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 751800; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 752048; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 752102; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 2969433; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4223551; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4225721; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4250745; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4257353; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4258403; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4284487; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4301381; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4304513; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4360263; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4371529; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4378617; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4390005; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4394975; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4403681; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4405911; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4411623; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4441387; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4475725; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 4477315; code bytes = 33c1 Found XOR loop in file "Broom.exe" at offset 171412; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 171439; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 171849; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 171876; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172115; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172139; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172364; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172445; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172468; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172492; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172520; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 172544; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 632057; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 749208; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1494445; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1499378; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1527668; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1534029; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1647056; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1656959; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1660710; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1683414; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1690242; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1874404; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 1932020; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2335633; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2339613; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2438552; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2487542; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2564565; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2698258; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2698330; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2698356; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 2704137; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3007389; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3178035; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3196123; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3390901; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3488098; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3502055; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3510588; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3520770; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3679280; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 3723862; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4166870; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4184466; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4213454; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4224030; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4237972; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4252254; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4256824; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4258836; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4263948; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4268236; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4268706; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4272994; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4273992; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4277572; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4286098; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4286624; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4290722; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4295448; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4300212; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4302548; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4303382; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4303872; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4304856; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4306654; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4310622; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4323560; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4324184; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4327980; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4329212; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4331564; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4338338; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4345638; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4347110; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4352628; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4357072; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4359624; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4365408; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4368810; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4371958; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4376506; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4383398; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4391652; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4396928; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4413582; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4418808; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4425096; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4429034; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4431508; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4433694; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4439310; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4440168; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4441244; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4442004; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4449753; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4450524; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4456826; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4460422; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4468210; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4477810; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4482044; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4482796; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4503412; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4505452; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4507496; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4509528; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4511556; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4513564; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4515544; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4518884; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4520040; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4521484; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4523006; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4525327; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4525451; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4526027; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 4526299; code bytes = 8030 Found XOR loop in file "Broom.exe" at offset 5057962; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 49675; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 65831; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 148456; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 332954; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 453792; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 569885; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 735522; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 757892; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 759608; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 793292; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 932490; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1049162; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1237020; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1251514; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1287196; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1319215; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1349662; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1460233; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1570842; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1627851; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1906647; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1949900; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2228356; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2257127; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2391763; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2475636; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2489366; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2577936; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2650249; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2674558; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2788968; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2804430; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2806524; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2831941; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2833363; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2968597; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2976998; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3081166; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3147203; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3188604; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3216722; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3272352; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3383889; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3414008; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3649736; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3849437; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3899707; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3914396; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3921189; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4127443; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4326595; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 18226; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 18847; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 294315; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 395833; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 404849; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 628547; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 655607; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 667316; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 749365; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 787821; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 829007; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 831588; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 857112; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 881669; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1131529; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1159513; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1250682; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1281756; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1302192; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1335431; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1582678; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1588139; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1649169; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1649244; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1806062; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1806556; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1816389; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1862755; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1897052; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1939097; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1948700; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2058493; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2087725; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2125436; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2174168; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2178401; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2219288; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2236353; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2259672; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2322018; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2544746; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2670355; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2701824; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2706575; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2886975; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3038440; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3185955; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3238201; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3245854; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3261955; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3287595; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3355933; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3392868; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3413020; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3692319; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3692540; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3891546; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3978992; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4174734; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4191572; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 78743; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 246038; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 264345; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 323945; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 350203; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 425062; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 467911; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 574013; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 577852; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 660378; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 839007; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 890134; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 978169; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 996907; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1150379; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1180351; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1187092; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1199397; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1250575; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1266785; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1302876; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1329280; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1389579; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1486809; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1578868; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1590078; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1641667; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1644211; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1777192; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1781971; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1792594; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1794693; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1821890; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1824009; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1840225; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1905480; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1921151; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2042867; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2145565; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2321297; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2443734; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2512326; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2645693; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2653904; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2702154; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2754841; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2762581; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2837027; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2860850; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2927768; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2930618; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2945432; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2989355; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3080218; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3136814; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3300770; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3358144; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3447707; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3487171; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3583704; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3585877; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3602605; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3631143; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3639504; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3710522; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3733350; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3781493; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3964897; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3993689; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4135031; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4326556; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 115432; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 169160; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 218143; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 435507; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 529384; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 654757; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 888196; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1047664; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1051432; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1052728; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1057806; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1115211; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1116673; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1133760; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1175640; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1216432; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1243691; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1282057; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1304302; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1398288; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1406695; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1428812; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1460224; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1567269; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1646426; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1684074; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 1955088; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 2286097; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 2297471; code bytes = 30d0 Found XOR loop in file "InstallSetup5.exe" at offset 76393; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 208271; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 391855; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 400738; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 409494; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 420768; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 503409; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 560618; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 606320; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 718109; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 860602; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1068474; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1173539; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1478808; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1699784; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1746125; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1817004; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1845342; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1866966; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1883994; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 1955277; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2126932; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2168070; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2181205; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2201856; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2235970; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 2238022; code bytes = 33c1 Found XOR loop in file "InstallSetup5.exe" at offset 99037; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 117205; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 174957; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 322596; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 440315; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 508850; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 548383; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 720842; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 723902; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 793200; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 911688; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 967956; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 990158; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1002800; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1052477; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1460761; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1504262; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1610233; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1625440; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1639060; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1650310; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1665433; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1741090; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1744558; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1821233; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 1910324; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 2026733; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 2256849; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 2270199; code bytes = 8030 Found XOR loop in file "InstallSetup5.exe" at offset 2307278; code bytes = 8030 Found XOR loop in file "toolspub2.exe" at offset 78606; code bytes = 30d0 Found XOR loop in file "toolspub2.exe" at offset 79153; code bytes = 30d0 Found XOR loop in file "toolspub2.exe" at offset 81859; code bytes = 30d0 Found XOR loop in file "toolspub2.exe" at offset 121176; code bytes = 30d0 Found XOR loop in file "toolspub2.exe" at offset 151340; code bytes = 30d0 Found XOR loop in file "toolspub2.exe" at offset 151838; code bytes = 30d0 Found XOR loop in file "toolspub2.exe" at offset 252989; code bytes = 30d0 Found XOR loop in file "toolspub2.exe" at offset 254369; code bytes = 30d0 Found XOR loop in file "toolspub2.exe" at offset 18642; code bytes = 33c1 Found XOR loop in file "toolspub2.exe" at offset 19263; code bytes = 33c1 Found XOR loop in file "toolspub2.exe" at offset 93701; code bytes = 33c1 Found XOR loop in file "toolspub2.exe" at offset 252734; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A992DEC.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6A992DEC.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A992DEC.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A992DEC.bin" at offset 78978; code bytes = 80302e:T596,file/memory contains long string with (Indicator: "GetCommandLine"; File: "toolspub2.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "DISMHOST.EXE.6A992DEC.bin") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005800-00000C2C-276048656") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp")2f:T450,Found system information discovery API: "GetUserObjectInformationA" in file "00000000-00005964.00000000.80611.00401000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStrings" in file "00000000-00005964.00000000.80611.00401000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in file "00000000-00005964.00000000.80611.00401000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoW" in file "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c" Found system information discovery API: "ExpandEnvironmentStringsW" in file "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c" Found system information discovery API: "WTSRegisterSessionNotification" in "00000000-00005776.00000000.80890.00822000.00000004.mdmp, 00000000-00005776.00000002.84736.00822000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00005776.00000000.80890.00822000.00000004.mdmp, 00000000-00005776.00000002.84736.00822000.00000004.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp"30:T48a,Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp")31:T990,Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00005964-00000C2C-271145734") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp")32:T80e,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000270132100256f004a0000000000000000000000008000000000000000256f004ac07626000100000000000000020000000c000000582f2600582f2600532f260000000000000000000000210000000001c0f5170000000000e0fb170095e1ea76c9920b00feffffff435cee765059ee7694000000a0000000522f2600502f26009400000064f71700fdfe527544f0170001000000e0fb170092e04269afd94af1fefffffffcf617004c9c42695c0c000010f717005f9c42690000000000000000 (UID: 00000000-00005636)33:T1585,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c005300300d250011000011f0f900003092260070132100b1080000aaa8640000200000b0080000580f00000d004200a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff5c00500000000000b1080000 (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb0477989b2b0000f0fd7f9a5cef7600a0fd7f24c0ec0444f0fd7f00000000400000003f0000002100000000f0fd7f18c0ec04c15cef766082f6762100000000f0fd7f9a5cef7600a0fd7f3cc0ec045789ee768083f6761317f074d8eb0477 (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005636) "toolspub2.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005964) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000fceb120000000000000000000000000010ec1200000000000000000000000000a50b9e9804ec1200186def7404ec12002a6def741c5ced764379ef74ffffffff0c0000004c62ed761f79ef74ffffffff0c00000018ec12000400000000040000010000002cec1200210e720200000000 (UID: 00000000-00005800) "Broom.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005776) "Broom.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f00f00700000000008c478473a0ef35008c47847300000000a0ef3500bcfe1200086dee761881f67600000000988d80000000000000000000fcfe120095e1ea7695be0b00feffffff6b2cef763119f074021000000000000000000100d0fe1200c89fee768c4784730000000000000000 (UID: 00000000-00005776) "Broom.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb047788eb36000050fd7f9a5cef7600f0fd7fc4c712004450fd7f00000000400000003f000000210000000050fd7fb8c71200c15cef766082f676210000000050fd7f9a5cef7600f0fd7fdcc712005789ee768083f6761317f074d8eb0477 (UID: 00000000-00005776) "Broom.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b20310000ecaf3400100000001c000000c8db1200ccdc12007ac8517008000000ac4eed769379ef74ffffffff30dc1200000000001cdc12000010000004000000002000003cdc1200bf79ef74ffffffff0000cb010000cb01001000000400000074dc1200000013006ee925700000cb01ff000000 (UID: 00000000-00005776) "Broom.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100205061636b20310000ecaf3400100000001c000000c8db1200ccdc12007ac8517008000000ac4eed769379ef74ffffffff30dc1200000000001cdc12000010000004000000002000003cdc1200bf79ef74ffffffff0000cb010000cb01001000000400000074dc1200000013006ee92570 (UID: 00000000-00005776) "Broom.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100205061636b203100205061636b20310000ecaf3400100000001c000000c8db1200ccdc12007ac8517008000000ac4eed769379ef74ffffffff30dc1200000000001cdc12000010000004000000002000003cdc1200bf79ef74ffffffff0000cb010000cb01001000000400000074dc1200 (UID: 00000000-00005776) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000fceb120000000000000000000000000010ec1200000000000000000000000000816228cd04ec1200186def7404ec12002a6def741c5ced764379ef74ffffffff0c0000004c62ed761f79ef74ffffffff0c00000018ec12000400000000040000010000002cec1200210e220200000000 (UID: 00000000-00004352)34:T432,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "InstallSetup5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "InstallSetup5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "toolspub2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "toolspub2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Broom.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")35:T591,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70B44000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp")36:T7b2,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp, 00000000-00005776.00000002.84736.70BD1000.00000020.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp")37:T834,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "8159676,5824,3024,,RtlGetVersion,NTDLL.dll,"252:06:23.739",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00005636.00000000.80120.00210000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp")38:T4f8,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\TOOLSPUB2.EXE") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\TOOLSPUB2.EXE") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\INSTALLSETUP5.EXE") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\INSTALLSETUP5.EXE") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LATESTX.EXE") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LATESTX.EXE") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\31839B57A4F11171D6ABC8BBC4451EE4.EXE") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\31839B57A4F11171D6ABC8BBC4451EE4.EXE")39:T419,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005636) "InstallSetup5.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005788) "InstallSetup5.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00005788) "InstallSetup5.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00005788) "InstallSetup5.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005788) "InstallSetup5.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00005788) "InstallSetup5.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005788) "InstallSetup5.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00005788) "Broom.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005776)3a:T49be,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter 8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00005636) "InstallSetup5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005788) "InstallSetup5.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005788) "InstallSetup5.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005788) "InstallSetup5.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005788) "InstallSetup5.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005788) "InstallSetup5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IconCodecService.dll (UID: 00000000-00005788) "InstallSetup5.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00005788) "toolspub2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005964) "toolspub2.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00005964) "toolspub2.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005964) "toolspub2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005964) "toolspub2.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005964) "toolspub2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005964) "toolspub2.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005964) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00005800) "Broom.exe" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter colorui.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter comdlg32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter compstui.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter inetres.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\EhStorShell.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\MICROS~3\Office14\GROOVEEX.DLL (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\MICROS~3\Office14\1033\GrooveIntlResource.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\imageres.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter UXTHEME (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter User32 (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter %TEMP%\Broom.exe (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00005776) "Broom.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00005776) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004352)3b:T14bf0,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005636) "InstallSetup5.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter WICCreateImagingFactory_Proxy (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00005788) "InstallSetup5.exe" called "GetProcAddress" with a parameter GetHGlobalFromStream (UID: 00000000-00005788) "toolspub2.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005964) "toolspub2.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005964) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WinStationQueryInformationW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NetUserGetInfo (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter QueryServiceStatusEx (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LsaAddAccountRights (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateProcessWithTokenW (UID: 00000000-00005800) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalA (UID: 00000000-00005800) "Broom.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter WinStationRegisterConsoleNotification (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipDrawArc (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipFillPie (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipDrawLine (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipCreatePen1 (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipDrawEllipse (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipFillEllipse (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipFillRectangle (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipSetSmoothingMode (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipDrawImageRectRect (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipCreateLineBrush (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipSetCompositingMode (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipSetCompositingQuality (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipBitmapLockBits (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipBitmapUnlockBits (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipCreatePathGradient (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipDeleteBrush (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipDeletePen (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipCreateEffect (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipSetEffectParameters (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipBitmapCreateApplyEffect (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipCreateHBITMAPFromBitmap (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipSetPenBrushFill (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipSetPathGradientCenterColor (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipSetPathGradientSurroundColorsWithCount (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipNewPrivateFontCollection (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipPrivateAddFontFile (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipGetFontCollectionFamilyList (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipGetFamilyName (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipDrawPolygon (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipFillPolygon (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipDrawImagePoints (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipDrawBeziers (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GdipSetInterpolationMode (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GradientFill (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter SHGetFileInfoW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter WICCreateImagingFactory_Proxy (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GrooveChainGetGlobalInterfacePtrAddress (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GrooveChainCoCreateInstance (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter EnumDateFormatsExEx (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetTextExtentExPointWPri (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetScrollBarInfo (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter GetSystemMetricsForDpi (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter SystemParametersInfoForDpi (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter SetLayout (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter UpdateLayeredWindow (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter AlphaBlend (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005776) "Broom.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005776) "toolspub2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006044) "toolspub2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006044) "toolspub2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006044) "toolspub2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006044) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WinStationQueryInformationW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00004352) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter QueryServiceStatusEx (UID: 00000000-00004352)3c:T416,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000002.84736.70B44000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp")3d:T41f,Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "at System.Diagnostics.Process.StartWithShellExecuteEx(System.Diagnostics.ProcessStartInfo)" (Indicator: "ShellExecute"; Source: "00000000-00005636.00000001.80515.00210000.00000004.mdmp") Found reference to API "at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo startInfo)" (Indicator: "ShellExecute"; Source: "00000000-00005636.00000001.80515.04ED0000.00000004.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp")3e:T693,Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp")3f:T487,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp")40:T549,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp, 00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70B44000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "HRESULT_FROM_WIN32(GetLastError())" (Indicator: "GetLastError"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp")41:T8a2,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005636.00000001.80515.00210000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005636.00000001.80515.00210000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005636.00000001.80515.00210000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005636.00000001.80515.00210000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005776.00000001.82813.00300000.00000004.mdmp 00000000-00005776.00000002.84736.00300000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005776.00000001.82813.00300000.00000004.mdmp 00000000-00005776.00000002.84736.00300000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005776.00000001.82813.00300000.00000004.mdmp 00000000-00005776.00000002.84736.00300000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00005776.00000001.82813.00300000.00000004.mdmp 00000000-00005776.00000002.84736.00300000.00000004.mdmp42:T10f5,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003116.00000000.90812.00BF1000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "HKEY_USERS\" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "483f7b2ab61d68d9c611c15cd59bcab01ee7084508c9bcdc2dce238def72cd67483f7b2ab61d68d9c611c15cd59bcab01ee7084508c9bcdc2dce238def72cd67HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "HKEY_USERS\1464" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005636.00000000.80120.00210000.00000004.mdmp 00000000-00005636.00000001.80515.00210000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005636.00000000.80120.00210000.00000004.mdmp 00000000-00005636.00000001.80515.00210000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005636.00000001.80515.00210000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005636.00000001.80515.00210000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005636.00000001.80515.00210000.00000004.mdmp "63127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005776.00000001.82813.00300000.00000004.mdmp 00000000-00005776.00000002.84736.00300000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00005776.00000001.82813.00300000.00000004.mdmp 00000000-00005776.00000002.84736.00300000.00000004.mdmp "Software\Microsoft\OneDrive" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp 00000000-00005776.00000002.84736.70DC1000.00000020.mdmp "Software\Microsoft\Windows Live\Common" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp 00000000-00005776.00000002.84736.70DC1000.00000020.mdmp "Software\Microsoft\Windows Live\Common\Activations\%d" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Policies\Microsoft\SQMClient" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Microsoft\SQMClient" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\Throttling" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Microsoft\SQMClient\Windows" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Policies\Microsoft\SQMClient\Windows" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Microsoft\SQMClient\UploadUrlMap" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp43:T6f7,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]44:T19a8,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003116.00000000.90812.00BF1000.00000020.mdmp "700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "HKEY_USERS\" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "483f7b2ab61d68d9c611c15cd59bcab01ee7084508c9bcdc2dce238def72cd67483f7b2ab61d68d9c611c15cd59bcab01ee7084508c9bcdc2dce238def72cd67HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "HKEY_USERS\1464" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005636.00000000.80120.00210000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005636.00000000.80120.00210000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005636.00000001.80515.00210000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005636.00000001.80515.00210000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005636.00000001.80515.00210000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005636.00000001.80515.00210000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005636.00000001.80515.00210000.00000004.mdmp "63127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005776.00000001.82813.00300000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00005776.00000001.82813.00300000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Microsoft\OneDrive" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Microsoft\Windows Live\Common" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Microsoft\Windows Live\Common\Activations\%d" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Policies\Microsoft\SQMClient" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Microsoft\SQMClient" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\Throttling" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Microsoft\SQMClient\Windows" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Policies\Microsoft\SQMClient\Windows" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "Software\Microsoft\SQMClient\UploadUrlMap" in Source: 00000000-00005776.00000001.82813.70B51000.00000020.mdmp "63127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005776.00000002.84736.00300000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00005776.00000002.84736.00300000.00000004.mdmp "Software\Microsoft\OneDrive" in Source: 00000000-00005776.00000002.84736.70DC1000.00000020.mdmp "Software\Microsoft\Windows Live\Common" in Source: 00000000-00005776.00000002.84736.70DC1000.00000020.mdmp "Software\Microsoft\Windows Live\Environment\Sync" in Source: 00000000-00005776.00000002.84736.70DC1000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00005776.00000002.84736.70DC1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\EnableAutoTray" in Source: 00000000-00005776.00000002.84736.70DC1000.00000020.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00005788.00000000.80604.00190000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005788.00000002.84449.00408000.00000002.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00005800.00000001.81930.0B800000.00000004.mdmp "HKEY_USERS\" in Source: 00000000-00005800.00000001.81930.0B900000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00005800.00000001.81930.0B900000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00005800.00000001.81930.0B900000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00005800.00000001.81930.0B900000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00005800.00000001.81930.0B900000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00005800.00000001.81930.0B900000.00000004.mdmp "41700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00005800.00000001.81930.0B900000.00000004.mdmp45:T37cc,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69390000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70ef0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "KERNEL32" at base 754e0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "ADVAPI32.DLL" at base 75750000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b290000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "SHLWAPI.DLL" at base 75de0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "VERSION.DLL" at base 74230000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 647b0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "USER32.DLL" at base 75280000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "MSCOREE.DLL" at base 6b320000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "PSAPI.DLL" at base 76fe0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "RPCRT4.DLL" at base 751a0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "KERNEL32.DLL" at base 754e0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 633a0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "OLE32.DLL" at base 75e40000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "CRYPTBASE.DLL" at base 74c90000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 69580000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 67de0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62940000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62120000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 739f0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "SHELL32.DLL" at base 75fa0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "PROPSYS.DLL" at base 73b20000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "COMCTL32.DLL" at base 73c90000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "OLEAUT32.DLL" at base 75d40000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "CLBCATQ.DLL" at base 75670000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73b20000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "NTMARTA.DLL" at base 74200000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75d00000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "PROFAPI.DLL" at base 74da0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "APPHELP.DLL" at base 74c40000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 70890000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75fa0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 754e0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "SETUPAPI.DLL" at base 76cf0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 74dc0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75390000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "SECUR32.DLL" at base 74ac0000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 74f70000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71480000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c40000 "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 69470000 "InstallSetup5.exe" loaded module "CRYPTBASE.DLL" at base 74c90000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 739f0000 "InstallSetup5.exe" loaded module "OLE32.DLL" at base 75e40000 "InstallSetup5.exe" loaded module "KERNEL32.DLL" at base 754e0000 "InstallSetup5.exe" loaded module "COMCTL32.DLL" at base 73c90000 "InstallSetup5.exe" loaded module "OLEAUT32.DLL" at base 75d40000 "InstallSetup5.exe" loaded module "ADVAPI32.DLL" at base 75750000 "InstallSetup5.exe" loaded module "SETUPAPI.DLL" at base 76cf0000 "InstallSetup5.exe" loaded module "RPCRT4.DLL" at base 751a0000 "InstallSetup5.exe" loaded module "CLBCATQ.DLL" at base 75670000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73b20000 "InstallSetup5.exe" loaded module "NTMARTA.DLL" at base 74200000 "InstallSetup5.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75d00000 "InstallSetup5.exe" loaded module "PROFAPI.DLL" at base 74da0000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 70e10000 "InstallSetup5.exe" loaded module "WINDOWSCODECS.DLL" at base 73140000 "InstallSetup5.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c40000 "toolspub2.exe" loaded module "KERNEL32.DLL" at base 754e0000 "toolspub2.exe" loaded module "MSIMG32.DLL" at base 6d850000 "toolspub2.exe" loaded module "USER32" at base 75280000 "toolspub2.exe" loaded module "KERNEL32" at base 754e0000 "toolspub2.exe" loaded module "NTDLL.DLL" at base 76e90000 "toolspub2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 739f0000 "toolspub2.exe" loaded module "DWMAPI.DLL" at base 735f0000 "toolspub2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c40000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "KERNEL32.DLL" at base 754e0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSIMG32.DLL" at base 69c00000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSVCR100.DLL" at base 694d0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "ADVAPI32.DLL" at base 75750000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "NTDLL.DLL" at base 76e90000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WINMM.DLL" at base 70680000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WS2_32.DLL" at base 75350000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "CRYPTBASE.DLL" at base 74c90000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 754e0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "POWRPROF.DLL" at base 73a70000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WTSAPI32.DLL" at base 73290000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WINSTA.DLL" at base 74d00000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75d00000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "RPCRT4.DLL" at base 751a0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "OLE32.DLL" at base 75e40000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "CLBCATQ.DLL" at base 75670000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "CRYPTSP.DLL" at base 747a0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74530000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "RPCRTREMOTE.DLL" at base 74d30000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 739f0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 69a90000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75750000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 71810000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 75d40000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "SXS.DLL" at base 74ca0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "OLEAUT32.DLL" at base 75d40000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6dcf0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 71be0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 71900000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 69620000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 695c0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "NETAPI32.DLL" at base 73470000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "SAMLIB.DLL" at base 73c20000 "Broom.exe" loaded module "MSCTF.DLL" at base 750d0000 "Broom.exe" loaded module "IMM32.DLL" at base 75d20000 "Broom.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 739f0000 "Broom.exe" loaded module "CRYPTBASE.DLL" at base 74c90000 "Broom.exe" loaded module "DWMAPI.DLL" at base 735f0000 "Broom.exe" loaded module "WTSAPI32.DLL" at base 73290000 "Broom.exe" loaded module "USER32.DLL" at base 75280000 "Broom.exe" loaded module "WINSTA.DLL" at base 74d00000 "Broom.exe" loaded module "ADVAPI32.DLL" at base 75750000 "Broom.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75d00000 "Broom.exe" loaded module "RPCRT4.DLL" at base 751a0000 "Broom.exe" loaded module "UXTHEME.DLL" at base 739f0000 "Broom.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 754e0000 "Broom.exe" loaded module "COMCTL32.DLL" at base 73c90000 "Broom.exe" loaded module "COLORUI.DLL" at base 695c0000 "Broom.exe" loaded module "SHELL32.DLL" at base 75fa0000 "Broom.exe" loaded module "COMDLG32.DLL" at base 77060000 "Broom.exe" loaded module "COMPSTUI.DLL" at base 69a80000 "Broom.exe" loaded module "INETRES.DLL" at base 69be0000 "Broom.exe" loaded module "GDIPLUS.DLL" at base 736d0000 "Broom.exe" loaded module "KERNEL32.DLL" at base 754e0000 "Broom.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 736d0000 "Broom.exe" loaded module "MSIMG32.DLL" at base 69c00000 "Broom.exe" loaded module "OLE32.DLL" at base 75e40000 "Broom.exe" loaded module "OLEAUT32.DLL" at base 75d40000 "Broom.exe" loaded module "CLBCATQ.DLL" at base 75670000 "Broom.exe" loaded module "SETUPAPI.DLL" at base 76cf0000 "Broom.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73b20000 "Broom.exe" loaded module "NTMARTA.DLL" at base 74200000 "Broom.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75d00000 "Broom.exe" loaded module "PROFAPI.DLL" at base 74da0000 "Broom.exe" loaded module "WINDOWSCODECS.DLL" at base 73140000 "Broom.exe" loaded module "APPHELP.DLL" at base 74c40000 "Broom.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 74dc0000 "Broom.exe" loaded module "%LOCALAPPDATA%\MICROSOFT\ONEDRIVE\17.3.4604.0120\FILESYNCSHELL.DLL" at base 70dc0000 "Broom.exe" loaded module "%WINDIR%\SYSTEM32\EHSTORSHELL.DLL" at base 70d80000 "Broom.exe" loaded module "%PROGRAMFILES%\MICROS~3\OFFICE14\GROOVEEX.DLL" at base 70220000 "Broom.exe" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\CULTURES\OFFICE.ODF" at base 6fe00000 "Broom.exe" loaded module "%PROGRAMFILES%\MICROS~3\OFFICE14\1033\GROOVEINTLRESOURCE.DLL" at base 6f590000 "Broom.exe" loaded module "UXTHEME" at base 739f0000 "Broom.exe" loaded module "USER32" at base 75280000 "Broom.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 70890000 "Broom.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75fa0000 "Broom.exe" loaded module "PROPSYS.DLL" at base 73b20000 "Broom.exe" loaded module "GDI32.DLL" at base 75700000 "Broom.exe" loaded module "COMCTL32" at base 73c90000 "Broom.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75e40000 "Broom.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 750d0000 "toolspub2.exe" loaded module "SHELL32" at base 75fa0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 69390000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSVCR100.DLL" at base 67db0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 69550000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 6951000046:Tdfe,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WBEM Scripting Locator" (Path: "HKCU\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "PSDispatch" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020420-0000-0000-C000-000000000046}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "PSEnumVariant" (Path: "HKCU\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS") "Broom.exe" touched "Enhanced Storage Icon Overlay Handler Class" (Path: "HKCU\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\INPROCSERVER32") "Broom.exe" touched "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" (Path: "HKCU\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\INPROCSERVER32") "Broom.exe" touched "Groove Explorer Icon Overlay 2 (GFS Stub)" (Path: "HKCU\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\INPROCSERVER32") "Broom.exe" touched "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" (Path: "HKCU\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\INPROCSERVER32") "Broom.exe" touched "Groove Explorer Icon Overlay 3 (GFS Folder)" (Path: "HKCU\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\INPROCSERVER32") "Broom.exe" touched "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" (Path: "HKCU\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\INPROCSERVER32")47:T1016,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "Broom.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,push ebx,mov eax, 0x7e608c,call 0x411608,mov ebx, dword ptr [0x801a80],mov eax, dword ptr [ebx],call 0x652328,mov cl, 1,mov edx, 0x7f31e8,mov eax, dword ptr [0x5db028],call 0x5f6190,mov ecx, dword ptr [0x80185c],mov eax, dword ptr [ebx],mov edx, dword ptr [0x783118],call 0x652340,mov ecx, dword ptr [0x801ce0],mov eax, dword ptr [ebx],mov edx, dword ptr [0x780dfc],call 0x652340,mov ecx, dword ptr [0x801590],mov eax, dword ptr [ebx],mov edx, dword ptr [0x781524]," "31839b57a4f11171d6abc8bbc4451ee4.exe" file has an entrypoint instructions - "call 0x408d78,jmp 0x404f8f,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov ecx, dword ptr [esp + 4],test ecx, 3,je 0x405150,mov al, byte ptr [ecx],add ecx, 1,test al, al,je 0x405183,test ecx, 3,jne 0x40512c,add eax, 0,lea esp, [esp],lea esp, [esp],mov eax, dword ptr [ecx],mov edx, 0x7efefeff,add edx, eax,xor eax, 0xffffffff,xor eax, edx,add ecx, 4,test eax, 0x81010100,je 0x405150,mov eax, dword ptr [ecx - 4],test al, al,je 0x4051a1," "InstallSetup5.exe" file has an entrypoint instructions - "sub esp, 0x3f8,push ebp,push esi,push edi,push 0x20,pop edi,xor ebp, ebp,push 0x8001,mov dword ptr [esp + 0x20], ebp,mov dword ptr [esp + 0x18], 0x40a2d8,mov dword ptr [esp + 0x14], ebp,call dword ptr [0x4080a4],mov esi, dword ptr [0x4080a8],lea eax, [esp + 0x34],push eax,mov dword ptr [esp + 0x4c], ebp,mov dword ptr [esp + 0x14c], ebp,mov dword ptr [esp + 0x150], ebp,mov dword ptr [esp + 0x38], 0x11c,call esi,test eax, eax,jne 0x4035be,lea eax, [esp + 0x34],mov dword ptr [esp + 0x34], 0x114,push eax,call esi," "toolspub2.exe" file has an entrypoint instructions - "call 0x40a499,jmp 0x40512b,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov ecx, dword ptr [esp + 4],test ecx, 3,je 0x4052f0,mov al, byte ptr [ecx],add ecx, 1,test al, al,je 0x405323,test ecx, 3,jne 0x4052cc,add eax, 0,lea esp, [esp],lea esp, [esp],mov eax, dword ptr [ecx],mov edx, 0x7efefeff,add edx, eax,xor eax, 0xffffffff,xor eax, edx,add ecx, 4,test eax, 0x81010100,je 0x4052f0,mov eax, dword ptr [ecx - 4],test al, al," "DISMHOST.EXE.6A992DEC.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"48:T97c,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "InstallSetup5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "InstallSetup5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "Broom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA")49:Tcbf,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005636-00000C2B-258419435] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005636-00000C2B-258717552] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005636-00000C2B-259758910] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005636-00000C2B-259883165] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005636-00000C2B-260113683] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005636-00000C2B-260175189] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005636-00000C2B-260514099] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005636-00000C2B-260766740] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005636-00000C2B-260832042] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005636-00000C2B-261259466] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005636-00000C2B-261317076] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00005636-00000C2B-261374590] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005636-00000C2B-261464893] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005636-00000C2B-261705027] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00005636-00000C2B-266828508] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" [Source: 00000000-00005636-00000C2B-267871728] Observed system executable string:"%WINDIR%\system32\IconCodecService.dll" [Source: 00000000-00005788-00000C2B-267104172] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00005800-00000C2B-280294904] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00005776-00000C2B-274775570] Observed system executable string:"%WINDIR%\system32\EhStorShell.dll" [Source: 00000000-00005776-00000C2B-276971127] Observed system executable string:"%WINDIR%\system32\imageres.dll" [Source: 00000000-00005776-00000C2B-279145514] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00005776-00000C2B-285174944] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00005776-00000C2B-285456169]4a:T547,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp")4b:T1057,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\USERSFILES\NAMESPACE"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32"; Key: ""; Value: "")4c:T129f,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "MAXIMIZEAPPS"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "MAXIMIZEAPPS"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXIMUMALLOWEDALLOCATIONSIZE"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: "SUPPRESSIONPOLICY"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}"; Key: "SUPPRESSIONPOLICY"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32"; Key: "LOADWITHOUTCOM"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE"; Key: "CLSID"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32"; Key: ""; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32"; Key: "LOADWITHOUTCOM"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "ATTRIBUTES"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "DESCRIPTIONID"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "HELPTOPIC"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "RECURSIVESEARCH"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "TARGETKNOWNFOLDER"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KINDMAP"; Key: ".EXE"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.EXE"; Key: ""; Value: "")4d:T6f7,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "c:\users\%osuser%\appdata\local\temp\installsetup5.exe" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "c:\users\%osuser%\appdata\local\temp\toolspub2.exe" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "c:\users\%osuser%\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exe" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "c:\windows\microsoft.net\assembly\gac_msil\system\v4.0_4.0.0.0__b77a5c561934e089\system.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "c:\8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" "InstallSetup5.exe" reads file "c:\users\%osuser%\appdata\local\temp\installsetup5.exe"4e:Tcfc,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\FLTLIB.DLL" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\MSVCP140.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\VCRUNTIME140.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\ucrtbase.DLL" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"4f:Tcf7,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\FLTLIB.DLL" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\MSVCP140.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\ucrtbase.DLL" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"50:Tc47,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe.config" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\brandrock\" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.INI" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe.Local\" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup5.exe:Zone.Identifier" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe:Zone.Identifier" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe:Zone.Identifier" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\latestX.exe:Zone.Identifier" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.PDB" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\8817CBB6DE1446A920401A072DF1453459AA95684FFC7DA9C05CA759B1836C0C.EXE.CONFIG" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\BRANDROCK" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\8817CBB6DE1446A920401A072DF1453459AA95684FFC7DA9C05CA759B1836C0C.INI" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" trying to access non-existent file "C:\8817CBB6DE1446A920401A072DF1453459AA95684FFC7DA9C05CA759B1836C0C.EXE.LOCAL"51:Tf13,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005800-00000C2C-275922259") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found reference to API "s_session.m_hHandle = ::WinHttpOpen( strwUserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, WINHTTP_FLAG_ASYNC)" (Indicator: "WinHttpOpen"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "hConnection = ::WinHttpConnect( m_hHandle, pszServer, nPort, NULL)" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::AutoDetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "hHttpSession = ::WinHttpOpen( strwUserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, WINHTTP_FLAG_ASYNC)" (Indicator: "WinHttpOpen"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::DetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::Reset" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::AsyncDetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::DetectProxies(m_ServerName, &m_proxyInfo)" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::AsyncDetectProxiesCallback" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::DoProxyFailover" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::SendRequest" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::CreateRequest" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "::WinHttpSendRequest(m_hHandle, 0, 0, 0, 0, m_cbTotalBodyLength, (DWORD_PTR)this)" (Indicator: "HttpSendRequest"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "::WinHttpSendRequest(m_hHandle, 0, 0, 0, 0, m_cbTotalBodyLength, (DWORD_PTR)this)" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "WinHttpQueryHeaders( m_hHandle, 22, 0, (LPVOID)lpOutBuffer, &dwSize, 0)" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "::WinHttpQueryHeaders( m_hHandle, 19 | 0x20000000, 0, &m_httpStatus, &cbStatusCode, 0)" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "::WinHttpReadData(m_hHandle, (LPVOID)pNextBuffer, cbBytesAvailable, nullptr)" (Indicator: "WinHttpReadData"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "ReferenceCountedPtr::Attach" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "ReferenceCountedPtr::CopyTo" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp")52:T12a8,Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "s_session.m_hHandle = ::WinHttpOpen( strwUserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, WINHTTP_FLAG_ASYNC)" (Indicator: "WinHttpOpen"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "WinHttpCrackUrl(pszUri, 0, 0, &urlComps)" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "hConnection = ::WinHttpConnect( m_hHandle, pszServer, nPort, NULL)" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::AutoDetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "hHttpSession = ::WinHttpOpen( strwUserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, WINHTTP_FLAG_ASYNC)" (Indicator: "WinHttpOpen"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::DetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::Reset" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::AsyncDetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::DetectProxies(m_ServerName, &m_proxyInfo)" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::AsyncDetectProxiesCallback" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::DoProxyFailover" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::SendRequest" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "CWinHttpConnection::CreateRequest" (Indicator: "WinHttpConnect"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "::WinHttpAddRequestHeaders(m_hHandle, header, header.length(), 0x20000000)" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "::WinHttpWriteData(m_hHandle, pbChunk, cbChunk, 0)" (Indicator: "WinHttpWriteData"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "((WINHTTP_STATUS_CALLBACK)(-1L)) != ::WinHttpSetStatusCallback(m_hHandle, (WINHTTP_STATUS_CALLBACK)CWinHttpRequest::HttpStatusCallback, dwNotificationFlags, 0) ? 1 : 0" (Indicator: "WinHttpSetStatusCallback"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "WinHttpSetOption( m_hHandle, 38, pProxyInfo, sizeof(WINHTTP_PROXY_INFO) )" (Indicator: "WinHttpSetOption"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "WinHttpSetOption( m_hHandle, 63, &optionBuffer, sizeof(optionBuffer) )" (Indicator: "WinHttpSetOption"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "WinHttpSetTimeouts(m_hHandle, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF)" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "::WinHttpSendRequest(m_hHandle, 0, 0, 0, 0, m_cbTotalBodyLength, (DWORD_PTR)this)" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "WinHttpQueryHeaders( m_hHandle, 22, 0, (LPVOID)lpOutBuffer, &dwSize, 0)" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "::WinHttpQueryHeaders( m_hHandle, 19 | 0x20000000, 0, &m_httpStatus, &cbStatusCode, 0)" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "::WinHttpQueryDataAvailable(m_hHandle, 0)" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "::WinHttpReadData(m_hHandle, (LPVOID)pNextBuffer, cbBytesAvailable, nullptr)" (Indicator: "WinHttpReadData"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp")53:T778,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00005800-00000C2C-275922259") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00004352.00000000.82248.01040000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found reference to API "ile System Bind Datame" (Indicator: " bind "; Source: "00000000-00005636.00000000.80120.00210000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00005636.00000000.80120.00210000.00000004.mdmp, 00000000-00005636.00000001.80515.00210000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00005636.00000000.80120.00210000.00000004.mdmp, 00000000-00005636.00000001.80515.00210000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005636.00000000.80120.01E50000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005776.00000000.80890.00CF0000.00000002.mdmp, 00000000-00005776.00000001.82813.00CF0000.00000002.mdmp, 00000000-00005776.00000002.84736.00CF0000.00000002.mdmp") Found reference to API "ile System Bind Data" (Indicator: " bind "; Source: "00000000-00005776.00000001.82813.00300000.00000004.mdmp, 00000000-00005776.00000002.84736.00300000.00000004.mdmp") Found reference to API "GetHostName" (Indicator: "gethostname"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp")54:T63a,Heuristic match: "ysc.kp" Heuristic match: "fc.gu" Heuristic match: "6qk.pt" Pattern match: "https://filesdumpplace.org" Heuristic match: "@vu7.vu" Pattern match: "http://k55dcgrv6gal6rwa2h4q3s4pg7gdtgtla2vkzi3zx3ikiqipz2uxuoid.onion" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "tem.co" Heuristic match: "admin.0.et" Heuristic match: "~df5f0721d3b42de902.tm" Heuristic match: "b95f4e7.tm" Heuristic match: "6a6cc22e4ed1d84.tm" Heuristic match: "a7311b468259d69.tm" Heuristic match: "~dfe8a1e01bfaff2921.tm" Heuristic match: "164d.tm" Heuristic match: "~dfb3f2cc227b95f4e7.tm" Heuristic match: "~dfea5b20c0e8f490c2.tm" Heuristic match: "ruewru%.ru" Pattern match: "sqm.microsoft.com/sqm/windowslive/sqmserver.dll" Pattern match: "www.embarcadero.com" Heuristic match: "font.name" Heuristic match: "bitmaphot.name" Heuristic match: "bitmaphot.top" Heuristic match: "bitmapfocused.name" Heuristic match: "bitmapfocused.top" Heuristic match: "bitmappressed.name" Heuristic match: "bitmappressed.top" Heuristic match: "bitmapdisabled.name" Heuristic match: "bitmapdisabled.top" Heuristic match: "bitmap.name" Heuristic match: "bitmap.top" Heuristic match: ".n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.n.nf" Pattern match: "http://ssw.live.com/uploaddata.aspx" Pattern match: "https://sqm.microsoft.com/sqm/%s/manifests/sqm%d.bin" Pattern match: "https://%s:%d%s" Heuristic match: "%qu5.ru" Heuristic match: "z+.kp" Pattern match: "http://fontawesome.io" Pattern match: "http://fontawesome.io/license/"55:T1b0f,Found URL "https://filesdumpplace.orghttp://k55dcgrv6gal6rwa2h4q3s4pg7gdtgtla2vkzi3zx3ikiqipz2uxuoid.onionhapubws-pcwbemscripting.swbemlocatorwbemscripting.swbemlocatorc:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exec:\windows\system32\kernel32.dllc:\users\hapubws\appdata\local\temp<<>>010o" - Source: "00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found URL "http://k55dcgrv6gal6rwa2h4q3s4pg7gdtgtla2vkzi3zx3ikiqipz2uxuoid.onionhttp://k55dcgrv6gal6rwa2h4q3s4pg7gdtgtla2vkzi3zx3ikiqipz2uxuoid.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\testappcommonprogramfiles=c:\program" - Source: "00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found URL "https://filesdumpplace.orghttps://filesdumpplace.org*struct" - Source: "00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found URL "http://k55dcgrv6gal6rwa2h4q3s4pg7gdtgtla2vkzi3zx3ikiqipz2uxuoid.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2ac:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exe" - Source: "00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found URL "https://filesdumpplace.org2026/09/03" - Source: "00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found URL "http://ssw.live.com/uploaddata.aspxsoftware\microsoft\windows" - Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found URL "https://sqm.microsoft.com/sqm/%s/manifests/sqm%d.bintestmanifesturldisablemanifestdownload%s/?partner=%shttps://copyuploadedfilestofoldersamplingintervalupload" - Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found URL "http:///default.htmtransfer-encoding:" - Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found URL "https://%s:%d%swlc-extended-statusauthdocumentnotfoundcontent-encodinggzipunknownmachineguid" - Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found URL "http://fontawesome.iohttp://fontawesome.io/license/vs_version_infostringfileinfo040904e4fileversion1.0.0.0productversion1.0.0.0programidcom.embarcadero.broomfiledescriptionbroomproductnamebroomvarfileinfotranslationembarcadero" - Source: "00000000-00005776.00000002.84736.00825000.00000002.mdmp") Found URL "http://fontawesome.iohttp://fontawesome.io/license/glassmusicsearchenvelopeheartstarstar_emptyuserfilmth_largeth_listremovezoom_inzoom_outsignaltrashhomefile_alttimeroaddownload_altdownloaduploadinboxplay_circlerepeatrefreshlist_altlockflagheadphonesvolume_offvolume_down" - Source: "00000000-00005776.00000002.84736.00825000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00005776.00000002.84736.00825000.00000002.mdmp") Found URL "http://sqm.microsoft.com/sqm/windowslive/sqmserver.dllsync" - Source: "00000000-00005776.00000002.84736.70DC1000.00000020.mdmp") Found URL "http://api.ipify.org/?format=weg/silent1023http://91.92.254.7/scripts/plus.php?ip=substr=five&s=ab/tostack/nocancelnsisdl.dllsyncupd.exehttp://lazzarotata.icu/syncupd.exedownload_quietsuccesshttp://arnaldomondo.icu/syncupd.exehttps://iplogger.com/1aiqk4software\broomcleanerinstallederror!" - Source: "00000000-00005788.00000000.80604.00190000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00005788.00000002.84449.0040A000.00000004.mdmp") Found URL "https://filesdumpplace.orghttp://k55dcgrv6gal6rwa2h4q3s4pg7gdtgtla2vkzi3zx3ikiqipz2uxuoid.onionc:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exec:\windows\system32\kernel32.dllc:\users\hapubws\appdata\local\tempc:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exe2026/09/03" - Source: "00000000-00005800.00000001.81930.0B800000.00000004.mdmp") Found URL "https://filesdumpplace.org2026/09/03" - Source: "00000000-00005800.00000001.81930.0B800000.00000004.mdmp") Found URL "https://filesdumpplace.orghttp://k55dcgrv6gal6rwa2h4q3s4pg7gdtgtla2vkzi3zx3ikiqipz2uxuoid.onionhttps://filesdumpplace.orghttp://k55dcgrv6gal6rwa2h4q3s4pg7gdtgtla2vkzi3zx3ikiqipz2uxuoid.onioncurrent" - Source: "00000000-00005800.00000001.81930.0B800000.00000004.mdmp") Found URL "http://k55dcgrv6gal6rwa2h4q3s4pg7gdtgtla2vkzi3zx3ikiqipz2uxuoid.onionhttp://k55dcgrv6gal6rwa2h4q3s4pg7gdtgtla2vkzi3zx3ikiqipz2uxuoid.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\testapps-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2a0b1c1115494a5c0a405601000f17134502120d431112025a0d5102560055050452040c11020709125303081f0a5b1f1d400c1808040a15195a101d060a1a055b0c0b0a070b0b1c1115494a5c0a405601000f17134502120d431112025a0d5102560055050452040c11020709125303081f0a5b1f1d400c1808040a15195a101d060a1a055b0c0b0a070bc11020709125303081f0a5b1f1d400c1808040a15195a101d060a1a055b0c0b0a070bmicrosoft" - Source: "00000000-00005800.00000001.81930.0B900000.00000004.mdmp") Found URL "https://filesdumpplace.orghttps://filesdumpplace.orgh?" - Source: "00000000-00005800.00000001.81930.0B900000.00000004.mdmp")56:T7ce,Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetDC" (Indicator: "GetDC"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp")57:T6d3,Found registry query API: "RegQueryInfoKeyW" in file "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c" Found registry query API: "RegSaveKeyW" in file "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c" Found registry query API: "RegQueryValueExW" in "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004352.00000001.82371.0B400000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004352.00000001.82371.0B400000.00000004.mdmp" Found registry query API: "RegOpenKeyTransactedW" in "00000000-00005776.00000001.82813.70B51000.00000020.mdmp, 00000000-00005776.00000002.84736.70DC1000.00000020.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp" Found registry query API: "RegNotifyChangeKeyValue" in "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp" Found registry query API: "SHRegGetUSValueW" in "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp" Found registry query API: "SHRegGetBoolUSValueW" in "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp"58:T51d,Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp")59:T78f,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "WTSQuerySessionInformationA" (Indicator: "WTSQuerySessionInformation"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found reference to API "getLookupAccountName" (Indicator: "LookupAccountName"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp")5a:Teac,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005636) "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005636)5b:T558,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70D1A000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70B44000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70B44000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp")5c:Tcf1,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "GetConsoleProcessList" (Indicator: "ProcessList"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000002.84736.70B44000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp")5d:T4e1,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp")5e:Td3f,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005776.00000001.82813.70D1A000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp")5f:T11cc,Found string "\Device\HarddiskVolume2\Windows\Temp\6ACE56DF-F776-4E4F-AA2D-EBB676EE6ED8\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00003116.00000000.90812.00200000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003116.00000001.91349.0024A000.00000004.mdmp") Found string ":\Windows\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003116.00000001.91349.0024A000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (Indicator: "\Device\"; Source: "00000000-00004352.00000000.82248.002F0000.00000004.mdmp, 00000000-00004352.00000001.82371.002F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00004352.00000000.82248.002F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00004352.00000000.82248.002F0000.00000004.mdmp, 00000000-00004352.00000001.82371.002F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00004352.00000000.82248.002F0000.00000004.mdmp, 00000000-00004352.00000001.82371.002F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00004352.00000000.82248.002F0000.00000004.mdmp, 00000000-00004352.00000001.82371.002F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00004352.00000000.82248.002F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004352.00000000.82248.002F0000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00004352.00000001.82371.002F0000.00000004.mdmp") Found string "indows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00004352.00000001.82371.002F0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004352.00000001.82371.002F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005636.00000000.80120.00210000.00000004.mdmp, 00000000-00005636.00000001.80515.00210000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005636.00000001.80515.00210000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005636.00000001.80515.00210000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005636.00000001.80515.00210000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005636.00000001.80515.00210000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005636.00000001.80515.00210000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005636.00000001.80515.00210000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005776.00000001.82813.00300000.00000004.mdmp, 00000000-00005776.00000002.84736.00300000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005776.00000001.82813.00300000.00000004.mdmp, 00000000-00005776.00000002.84736.00300000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005776.00000001.82813.00300000.00000004.mdmp, 00000000-00005776.00000002.84736.00300000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005776.00000001.82813.00300000.00000004.mdmp, 00000000-00005776.00000002.84736.00300000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005776.00000001.82813.00300000.00000004.mdmp, 00000000-00005776.00000002.84736.00300000.00000004.mdmp")60:T50d,Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "?AllowedDeleteFileResult@ScenarioQosDelegatedSyncWrapper@QoS@@QAE_NJ@Z" (Indicator: "DeleteFile"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "?StartDeleteFile@ScenarioQosDelegatedSyncWrapper@QoS@@QAEXXZ" (Indicator: "DeleteFile"; Source: "00000000-00005776.00000001.82813.70B51000.00000020.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70B44000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp")61:T40c,Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00005776.00000001.82813.70DD8000.00000002.mdmp")62:Tf1d,Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "AddAce" (Indicator: "AddAce"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp")63:T49e,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "00000000-00005964.00000000.80611.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003116.00000000.90812.00BF1000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005776.00000001.82813.70C9A000.00000004.mdmp") Found reference to API "__crtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70B44000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp, 00000000-00005776.00000002.84736.70BD1000.00000020.mdmp")64:Td41,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6A992DEC.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6A992DEC.bin]65:T913,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "InstallSetup5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "InstallSetup5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "InstallSetup5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "InstallSetup5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "")66:Ta3d,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVERS"; Value: "https://filesdumpplace.org") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "UUID"; Value: "000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "FIRSTINSTALLDATE"; Value: "66E4986A0000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVICEVERSION"; Value: "000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "PGDSE"; Value: "000000000000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVERSVERSION"; Value: "C30000000000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "OSCAPTION"; Value: "Microsoft Windows 7 Professional") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "OSARCHITECTURE"; Value: "32-bit") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "ISADMIN"; Value: "3100000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "AV"; Value: "000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "PATCHTIME"; Value: "000000000000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "CPU"; Value: "Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz"), "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "GPU"; Value: "VMware SVGA 3D"), "Broom.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\BROOM"; Key: "KEY"; Value: "XZWEN-27MCX-Z9JD1-USCSW"), "Broom.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\BROOM"; Key: "DATE"; Value: "B6B032C38697E64000")67:T457,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini"68:T89b,"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" wrote 17695 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup5.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" wrote 64000 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" wrote 31640 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe" wrote 42264 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\latestX.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "InstallSetup5.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\Broom.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ...69:T4b4,RegCloseKey OpenProcessToken RegOpenKeyExW GetUserNameW RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegDeleteValueW CreateThread GetComputerNameW GetCommandLineW CreateDirectoryW WinExec FindNextFileW Sleep OpenProcess MapViewOfFile LoadLibraryA GetFileSize GetSystemInfo ExitThread GetTickCount CreateFileW FindResourceW FindFirstFileW LockResource WriteProcessMemory LoadLibraryExW DeleteFileW CreateFileMappingW ReadProcessMemory GetModuleFileNameW GetDriveTypeW UnhandledExceptionFilter GetProcAddress VirtualAlloc WriteFile IsDebuggerPresent GetFileAttributesW GetModuleHandleW CreateProcessW LoadLibraryW GetVersionExW VirtualAllocEx GetStartupInfoW VirtualProtect ShellExecuteExW ShellExecuteW FindWindowExW GetClipboardData SetWindowsHookExW GetCursorPos GetLastActivePopup SetKeyboardState FindWindowW GetWindowThreadProcessId EnumPrintersW TerminateProcess GetModuleFileNameA GetStartupInfoA CreateFileA RegEnumKeyW GetTempFileNameW GetModuleHandleA CopyFileW GetSystemDirectoryW GetTempPathW GetCommandLineA SetSecurityDescriptorDacl OutputDebugStringA OutputDebugStringW GetVersionExA FindResourceExW GetModuleHandleExW6a:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}6b:T53b,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")6c:T88c,"powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\67D147D5DAB7F28D663CA5B7A9568F087427B9F7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A399046417B67E320D3EFA69D7DCE6B8BFE8A9F2"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB")6d:Te96,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: brandrock.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001380-00000C25-39763255] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001380-00000C25-39981846] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001380-00000C25-40045633] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001380-00000C25-40091318] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001380-00000C25-40178949] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001380-00000C25-40213098] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001380-00000C25-40243333] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001380-00000C25-40299741] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001380-00000C25-40401698] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001380-00000C25-40437361] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001380-00000C25-40487459] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001380-00000C25-40500473] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00001380-00000C25-40515516] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001380-00000C25-40573095] Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00001936-00000C25-42580984] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00001936-00000C25-42597752] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00001936-00000C25-42611119] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00001936-00000C25-42796618] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00001936-00000C25-42810837] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00001936-00000C25-42866378] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00001936-00000C25-42882051] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00001936-00000C25-42914559] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00001936-00000C25-42929963] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00001936-00000C25-42946893]6e:T511,"brandrock.exe" queries basic process information of the "C:\brandrock.exe" (UID: 1380) "brandrock.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup5.exe" (UID: 1380) "brandrock.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (UID: 1380) "brandrock.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 1380) "brandrock.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\latestX.exe" (UID: 1380) "InstallSetup5.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\Broom.exe" (UID: 1936) "toolspub2.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (UID: 7556) "31839b57a4f11171d6abc8bbc4451ee4.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 2500) "31839b57a4f11171d6abc8bbc4451ee4.exe" queries basic process information of the "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (UID: 2500) "Broom.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\Broom.exe" (UID: 7408)6f:T59b,"Broom.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "134285922" "cx": "1" "cy": "1"} "Broom.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1476462741" "cx": "1" "cy": "1"} "Broom.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "83954261" "cx": "16" "cy": "16"} "Broom.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "83954261" "cx": "16" "cy": "24"} "Broom.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "83954261" "cx": "26" "cy": "24"} "Broom.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "83954261" "cx": "16" "cy": "14"} "Broom.exe" called "CreateCompatibleBitmap" (UID: 00000000-00007408) "Broom.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "83954261" "cx": "32" "cy": "32"} "Broom.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "83954261" "cx": "64" "cy": "16"} "Broom.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "83954261" "cx": "64" "cy": "64"} "Broom.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "83954261" "cx": "4800" "cy": "64"} "Broom.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844217" "cx": "320" "cy": "20"} "Broom.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844217" "cx": "5" "cy": "215"} "Broom.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844217" "cx": "320" "cy": "5"}70:T984,"brandrock.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001380) "brandrock.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00001380) "brandrock.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001380)71:Tde8,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001380.00000000.67117.042C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001380.00000000.67117.042C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001380.00000000.67117.042C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001380.00000000.67117.042C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001380.00000000.67117.042C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001380.00000000.67117.042C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001380.00000000.67117.042C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001380.00000000.67117.042C0000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001936.00000002.71153.00408000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002500.00000000.67392.03180000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002500.00000000.67392.03180000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002500.00000000.67392.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002500.00000000.67392.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002500.00000000.67392.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002500.00000000.67392.03180000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002500.00000000.67392.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002500.00000000.67392.03180000.00000004.mdmp") Found reference to API "11248726206,1308,3153,,CreateCompatibleBitmap,Gdi32.dll,"00:17:33.890",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007408.00000000.67452.03660000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007408.00000002.71293.0081D000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00007408.00000002.71293.0081D000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007408.00000002.71293.0081D000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00007408.00000002.71293.0081D000.00000004.mdmp")72:T4bc,"brandrock.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup5.exe" (Handle: 1492) "brandrock.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (Handle: 780) "brandrock.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (Handle: 1556) "InstallSetup5.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\Broom.exe" (Handle: 772) "toolspub2.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (Handle: 408) "toolspub2.exe" wrote 00000200 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (Handle: 408) "toolspub2.exe" wrote 00007200 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe" (Handle: 408) "31839b57a4f11171d6abc8bbc4451ee4.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 852) "31839b57a4f11171d6abc8bbc4451ee4.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 736)73:T520,Spawned process "brandrock.exe" (UID: 00000000-00001380) Spawned process "InstallSetup5.exe" (UID: 00000000-00001936) Spawned process "toolspub2.exe" (UID: 00000000-00007556) Spawned process "31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 00000000-00002500) Spawned process "Broom.exe" (UID: 00000000-00007408) Spawned process "latestX.exe" (UID: 00000000-00000812) Spawned process "toolspub2.exe" (UID: 00000000-00007388) Spawned process "powershell.exe" with commandline "powershell -nologo -noprofile" (UID: 00000000-00007476) Spawned process "WerFault.exe" with commandline "-pss -s 464 -p 7476 -ip 7476" (UID: 00000000-00004272) Spawned process "WerFault.exe" with commandline "-u -p 7476 -s 2540" (UID: 00000000-00002524) Spawned process "WerFault.exe" with commandline "-u -p 7476 -s 2540" (UID: 00000000-00001428) Spawned process "31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 00000000-00006212) Spawned process "powershell.exe" with commandline "powershell -nologo -noprofile" (UID: 00000000-00007656) Spawned process "WerFault.exe" with commandline "-pss -s 464 -p 7656 -ip 7656" (UID: 00000000-00006512) Spawned process "WerFault.exe" with commandline "-u -p 7656 -s 1212" (UID: 00000000-00006052) Spawned process "WerFault.exe" with commandline "-u -p 7656 -s 1212" (UID: 00000000-00004188)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791617918805,"unified_at":"2026-10-10T07:38:38.805Z","metadata":{"hashes":{"sha256":"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","sha1":"f2472fb321a388b7310be0260e1f1e66e04188b6","md5":"deb1df6e8090653848506c1e9a1e32f8","sha512":"cb9fbdabba1ea1efe44f7f712f0bbbafff0da482c7209d2e1befff1238b83a5beb6d3ccfd5bfa83aab20d40308e4412f2a54dbf03132e42c990447e3fed6e5aa","ssdeep":"196608:WgDX5c0qzDZFcwUe0IssfcRpQbXkLWjRppNaA/vc2dMMM+fBRhu:WgDpc0eZ+Le0Yqab0ajzpNlvJO+N","ssdeep_chunks":["196608:WgDX5c0","196608:gDX5c0q","196608:DX5c0qz","196608:X5c0qzD","196608:5c0qzDZ","196608:c0qzDZF","196608:0qzDZFc","196608:qzDZFcw","196608:zDZFcwU","196608:DZFcwUe","196608:ZFcwUe0","196608:FcwUe0I","196608:cwUe0Is","196608:wUe0Iss","196608:Ue0Issf","196608:e0Issfc","196608:0IssfcR","196608:IssfcRp","196608:ssfcRpQ","196608:sfcRpQb","196608:fcRpQbX","196608:cRpQbXk","196608:RpQbXkL","196608:pQbXkLW","196608:QbXkLWj","196608:bXkLWjR","196608:XkLWjRp","196608:kLWjRpp","196608:LWjRppN","196608:WjRppNa","196608:jRppNaA","196608:RppNaA/","196608:ppNaA/v","196608:pNaA/vc","196608:NaA/vc2","196608:aA/vc2d","196608:A/vc2dM","196608:/vc2dMM","196608:vc2dMMM","196608:c2dMMM+","196608:2dMMM+f","196608:dMMM+fB","196608:MMM+fBR","196608:MM+fBRh","196608:M+fBRhu","393216:WgDX5c0","393216:gDX5c0q","393216:DX5c0qz","393216:X5c0qzD","393216:5c0qzDZ","393216:c0qzDZF","393216:0qzDZFc","393216:qzDZFcw","393216:zDZFcwU","393216:DZFcwUe","393216:ZFcwUe0","393216:FcwUe0I","393216:cwUe0Is","393216:wUe0Iss","393216:Ue0Issf","393216:e0Issfc","393216:0IssfcR","393216:IssfcRp","393216:ssfcRpQ","393216:sfcRpQb","393216:fcRpQbX","393216:cRpQbXk","393216:RpQbXkL","393216:pQbXkLW","393216:QbXkLWj","393216:bXkLWjR","393216:XkLWjRp","393216:kLWjRpp","393216:LWjRppN","393216:WjRppNa","393216:jRppNaA","393216:RppNaA/","393216:ppNaA/v","393216:pNaA/vc","393216:NaA/vc2","393216:aA/vc2d","393216:A/vc2dM","393216:/vc2dMM","393216:vc2dMMM","393216:c2dMMM+","393216:2dMMM+f","393216:dMMM+fB","393216:MMM+fBR","393216:MM+fBRh","393216:M+fBRhu","196608:WgDpc0e","196608:gDpc0eZ","196608:Dpc0eZ+","196608:pc0eZ+L","196608:c0eZ+Le","196608:0eZ+Le0","196608:eZ+Le0Y","196608:Z+Le0Yq","196608:+Le0Yqa","196608:Le0Yqab","196608:e0Yqab0","196608:0Yqab0a","196608:Yqab0aj","196608:qab0ajz","196608:ab0ajzp","196608:b0ajzpN","196608:0ajzpNl","196608:ajzpNlv","196608:jzpNlvJ","196608:zpNlvJO","196608:pNlvJO+","196608:NlvJO+N"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"brandrock.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":12814848,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1700310104000,"last_seen":1788401858000,"last_multi_scan":1788401858000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["urlscanio","commodity","criminal","smokeloader","downloader","evasive","pua","windows-server-utility"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":104},"sandbox_signatures":{"informative_count":301,"suspicious_count":25,"malicious_count":19,"total":345},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"IL:Trojan.ClipBanker.56","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"IL:Trojan.ClipBanker.56 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.UZA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"VirTool/MSIL.Obfuscator.su","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005a8b921 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/ILAgent-I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-FVZC!DEB1DF6E8090","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.FFY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.UGJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3769904","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"IL:Trojan.ClipBanker","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"SmokeLoader","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Contains ability to measure performance"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"},{"type":"informative","value":"Attempts to read volume data via DOS device path"},{"type":"informative","value":"Contains the ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Able to detect if debugger is present"},{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment devices"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns many processes"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"},{"type":"informative","value":"References Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"YARA signature match - Compress data using CryptoPP library"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","identifiers":[{"type":"suspicious","value":"Contains Tor Onion URL"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"},{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a computer-based training (CBT) hook"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"malicious","value":"Writes to the hosts file"}],"sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"Found reference to API \"Select * from Win32_ComputerSystem\" (Indicator: \"select\"; Source: \"sample.bin\"), Found reference to API \" RtEe\" (Indicator: \"tee\"; Source: \"sample.bin\"), Found reference to API \"lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\" (Indicator: \"read\"; Source: \"sample.bin\"), Found reference to API \"lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\" (Indicator: \"time\"; Source: \"sample.bin\"), Found reference to API \"eTeEe\" (Indicator: \"tee\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: sample.bin, Indicator: \"select * from win32_computersystem\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"SbieDll.dll\" (Indicator: \"sbiedll.dll\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"dd_dotnet48_decompression_log.txt\" (Source: \"00000000-00005636.00000001.80515.00210000.00000004.mdmp\")\n Found string \"unknown compression method\" (Source: \"00000000-00005776.00000001.82813.007F4000.00000004.mdmp, 00000000-00005776.00000001.82813.70B51000.00000020.mdmp, 00000000-00005776.00000002.84736.007F4000.00000004.mdmp\")\n file/memory contains long string(Source: \"00000000-00005776.00000002.84736.00825000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"VirtualFreeEx\" (Indicator: \"VirtualFree\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003116.00000000.90812.00BF1000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$25","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"RegReplaceKeyW\" (Indicator: \"RegReplaceKey\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"RegRestoreKeyW\" (Indicator: \"RegRestoreKey\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")\n Found reference to API \"RegSetKeyValueW\" (Indicator: \"RegSetKeyValue\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70D1A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c has big resource with name: \"toolspub2\" size: \"260608\" and abnormal entropy:\"7.464861971997759\"\n 8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c has big resource with name: \"InstallSetup5\" size: \"2311455\" and abnormal entropy:\"7.998815773229108\"\n 8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c has big resource with name: \"latestX\" size: \"5874968\" and abnormal entropy:\"7.832825538856017\"\n 8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c has big resource with name: \"31839b57a4f11171d6abc8bbc4451ee4\" size: \"4357016\" and abnormal entropy:\"7.986752700918854\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005800.00000001.81930.0B900000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005964.00000001.80798.001EF000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005964.00000001.80798.00340000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006044.00000000.81103.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2; Source: \"00000000-00004352.00000001.82371.002F0000.00000004.mdmp\")\n Found string - \\\\.\\VBoxGuest; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string - \\\\.\\VBoxTrayIPC; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string - \\\\.\\VBoxMiniRdrDN; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" queried SystemProcessInformation at 00000000-00005800-00000105-24005447 [PID: 5800]\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" queried SystemProcessInformation at 00000000-00004352-00000105-6400761 [PID: 4352]\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" queried SystemProcessInformation at 00000000-00004352-00000105-6411478 [PID: 4352]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Able to detect if debugger is present","description":"Observed API \"CheckRemoteDebuggerPresent\" in \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"","origin":"Static Parser","mitre_attack_id":"T1622","relevance":1,"id":"static-220","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".ndata\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor dh\n byte ptr [edx+424E54B5h] in Stream UID: 00000000-00006044-22811-2-00402EB8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003116.00000000.90812.00200000.00000004.mdmp, 00000000-00003116.00000001.91349.0024A000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004352.00000000.82248.002F0000.00000004.mdmp, 00000000-00004352.00000001.82371.002F0000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005636.00000000.80120.00210000.00000004.mdmp, 00000000-00005636.00000001.80515.00210000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005776.00000001.82813.00300000.00000004.mdmp, 00000000-00005776.00000002.84736.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Able to decode string content at runtime (.NET)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - Compress data using CryptoPP library","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"getUserNameResult\" (Source: \"00000000-00005776.00000001.82813.70B51000.00000020.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00005776.00000001.82813.70B51000.00000020.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"vgauthservice.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"[system process]vboxtray.exe\" (Indicator: \"vboxtray.exe\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"vboxservice.exe\" (Indicator: \"vboxservice.exe\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"vboxtray.exe\" (Indicator: \"vboxtray.exe\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"\\\\.\\VBoxGuest\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"VBoxWddm\" (Indicator: \"VBoxWddm\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"VBoxMouse\" (Indicator: \"VBoxMouse\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"VBoxGuest\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"VBoxSF\" (Indicator: \"VBoxSF\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"vboxguestadditions\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00005636.00000001.80515.04ED0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"\\\\.\\VBoxGuest\" (Indicator: \"\\vboxguest\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"\\\\.\\VBoxTrayIPC\" (Indicator: \"\\vboxtrayipc\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"\\\\.\\VBoxMiniRdrDN\" (Indicator: \"\\vboxminirdrdn\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"\\\\.\\pipe\\VBoxMiniRdDN\" (Indicator: \"\\pipe\\vboxminirddn\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"\\\\.\\pipe\\VBoxTrayIPC\" (Indicator: \"\\vboxtrayipc\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005636-00000C2C-259881325\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005636-00000C2C-259882102\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005636-00000C2C-263628554\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatusEx\" (Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003116.00000000.90812.00BF1000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005776.00000001.82813.70D1A000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"EnumDateFormatsExW\" (Indicator: \"EnumDateFormats\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00005636)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005636)\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005636)\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005636)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005636)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005636)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"IsWow64Process\" with parameter \"5636\" - (UID: 00000000-00005636)\n \"InstallSetup5.exe\" called \"IsWow64Process\" with parameter \"5788\" - (UID: 00000000-00005788)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"IsWow64Process\" with parameter \"5800\" - (UID: 00000000-00005800)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"Broom.exe\" called \"EnumWindows\" with parameter \"1244336\" - (UID: 00000000-00005776)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"Broom.exe\" called \"GetWindowTextW\" with parameter \"Start\" - (UID: 00000000-00005776)\n \"Broom.exe\" called \"GetWindowTextW\" with parameter \"1a044d04480420004f0066006600690063006500\" - (UID: 00000000-00005776)\n \"Broom.exe\" called \"GetWindowTextW\" with parameter \"1a044d044804200032043e0441044104420430043d043e0432043b0435043d0438044f0420004f0066006600690063006500\" - (UID: 00000000-00005776)\n \"Broom.exe\" called \"GetWindowTextW\" with parameter \"1b043e043a0430043b044c043d043e04350420004504400430043d0438043b04380449043504\" - (UID: 00000000-00005776)\n \"Broom.exe\" called \"GetWindowTextW\" with parameter \"12044b04340435043b04380442044c042f001e043104400430044204380442044c04\" - (UID: 00000000-00005776)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005636)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"Broom.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00005776)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005800)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005800)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005800)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidA\" with param Name SYSTEM (UID: 00000000-00005800)\n \"Broom.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005776)\n \"Broom.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00005776)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004352)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004352)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005636)\n \"Broom.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005776)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: Broom.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: InstallSetup5.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005776.00000000.80890.00822000.00000004.mdmp, 00000000-00005776.00000001.82813.70B51000.00000020.mdmp, 00000000-00005776.00000002.84736.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameA\" (Indicator: \"GetVolumePathName\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$34","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-451","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set\" (Indicator: \"set\"; File: \"screen_1.png\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"c:\\windows\\rss\\csrss.exeGetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"Broom.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" queries volume information of \"C:\\8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" at 00000000-00005636-0000010C-3081345","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"InstallSetup5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Broom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$38","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT Name FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegLoadKeyW\" in file \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"\n Found registry modification API: \"RegConnectRegistryW\" in file \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyTransactedW\" in \"00000000-00005776.00000001.82813.70B51000.00000020.mdmp, 00000000-00005776.00000002.84736.70DC1000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"at System.Diagnostics.Process.StartWithShellExecuteEx(System.Diagnostics.ProcessStartInfo)\" (Source: \"00000000-00005636.00000001.80515.00210000.00000004.mdmp\")\n Found string \"at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo startInfo)\" (Source: \"00000000-00005636.00000001.80515.04ED0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"toolspub2.exe\")\n file/memory contains long string(File: \"DISMHOST.EXE.6A992DEC.bin\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003116.00000000.90812.00BF1000.00000020.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003116.00000000.90812.00BF1000.00000020.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$39","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\InstallSetup5.exe\"\" - (UID: 00000000-00005636)\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\toolspub2.exe\"\" - (UID: 00000000-00005636)\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe\"\" - (UID: 00000000-00005636)\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\latestX.exe\"\" - (UID: 00000000-00005636)\n \"InstallSetup5.exe\" called \"CreateProcessW\" with parameter \"%TEMP%\\Broom.exe\" - (UID: 00000000-00005788)\n \"toolspub2.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\toolspub2.exe\"\" - (UID: 00000000-00005964)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\jota42\\gobu\\lutu_vedibu\\xenuvanikem\\yen\\11.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")\n Found reference to API \"SHCreateDirectoryExW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70B44000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003116.00000000.90812.00BF1000.00000020.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: Broom.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 31839b57a4f11171d6abc8bbc4451ee4.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: toolspub2.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003116.00000000.90812.00BF1000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.get_StartInfo\" in \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"\n Observed function \"Process.Start\" in \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"Broom.exe\" contains export function called \"TMethodImplementationIntercept\" at ordinal 3\n \"Broom.exe\" contains export function called \"__dbk_fcall_wrapper\" at ordinal 2\n \"Broom.exe\" contains export function called \"dbkFCallWrapperAddr\" at ordinal 1","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$41","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: InstallSetup5.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$42","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process 8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process 8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Broom.exe\" as clean (type is \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 11 sections\"), Antivirus vendors marked dropped file \"DISMHOST.EXE.6A992DEC.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"InstallSetup5.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"DISMHOST.EXE.6A992DEC.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"GetModuleHandle\" in \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"\n Observed unmanaged function \"CheckRemoteDebuggerPresent\" in \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\VBoxMiniRdDN\n Found string - \\\\.\\pipe\\VBoxTrayIPC","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$44","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 77010000\n \"InstallSetup5.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 77010000\n \"Broom.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 77010000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$45","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 633A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 748B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64000000\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 647B0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 751A0000\n \"InstallSetup5.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 751A0000\n \"toolspub2.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 751A0000\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 751A0000\n \"Broom.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 751A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1500160020734369@ADVAPI32.dll\"\n \"0e000f00e4734369@ADVAPI32.dll\"\n \"0e000f0050744369@ADVAPI32.dll\"\n \"11001200d47d4369@ADVAPI32.dll\"\n \"110012007c7e4369@ADVAPI32.dll\"\n \"12001300cc7e4369@ADVAPI32.dll\"\n \"12001300387f4369@ADVAPI32.dll\"\n \"14001500e4b74369@ADVAPI32.dll\"\n \"1400150000b84369@ADVAPI32.dll\"\n \"140015001cb84369@ADVAPI32.dll\"\n \"1700180038b84369@ADVAPI32.dll\"\n \"0d000e0054b84369@ADVAPI32.dll\"\n \"1100120064b84369@ADVAPI32.dll\"\n \"110012007cb84369@ADVAPI32.dll\"\n \"0f001000ecb94369@ADVAPI32.dll\"\n \"1400150038ba4369@ADVAPI32.dll\"\n \"1400150054ba4369@ADVAPI32.dll\"\n \"0c000d00a8ba4369@ADVAPI32.dll\"\n \"0c000d00b8ba4369@ADVAPI32.dll\"\n \"0e000f00c8ba4369@ADVAPI32.dll\"\n \"0e000f00dcba4369@ADVAPI32.dll\"\n \"0b000c00f0ba4369@ADVAPI32.dll\"\n \"180019008cbd4369@RPCRT4.dll\"\n \"13001400bcbd4369@RPCRT4.dll\"\n \"14001500d4bd4369@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\" was detected as \".NET\" and name: \"Library\"\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"Broom.exe\" was detected as \".NET\" and name: \"Library\"\n \"Broom.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" was detected as \".NET\" and name: \"Library\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"InstallSetup5.exe\" was detected as \".NET\" and name: \"Library\"\n \"InstallSetup5.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"toolspub2.exe\" was detected as \".NET\" and name: \"Library\"\n \"toolspub2.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"DISMHOST.EXE.6A992DEC.bin\" was detected as \".NET\" and name: \"Library\"\n \"DISMHOST.EXE.6A992DEC.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$46","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"toolspub2.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"DISMHOST.EXE.6A992DEC.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\" has an executable section named \".text\"\n \"Broom.exe\" has an executable section named \".text\"\n \"Broom.exe\" has an executable section named \".itext\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has an executable section named \".text\"\n \"InstallSetup5.exe\" has an executable section named \".text\"\n \"toolspub2.exe\" has an executable section named \".text\"\n \"DISMHOST.EXE.6A992DEC.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"user32.dll\" : \"216\" [Source: Broom.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Broom.exe\" has an writable section named \".data\"\n \"Broom.exe\" has an writable section named \".bss\"\n \"Broom.exe\" has an writable section named \".idata\"\n \"Broom.exe\" has an writable section named \".didata\"\n \"Broom.exe\" has an writable section named \".tls\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has an writable section named \".data\"\n \"InstallSetup5.exe\" has an writable section named \".data\"\n \"InstallSetup5.exe\" has an writable section named \".ndata\"\n \"toolspub2.exe\" has an writable section named \".data\"\n \"DISMHOST.EXE.6A992DEC.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$47","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0xc38000\" greater than 0x100000\n Raw size of \".text\" is \"0x3ed600\" greater than 0x100000\n Raw size of \".text\" is \"0x403e00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0xc37f54\" greater than 0x100000\n Virtual size of \".text\" is \"0x3ed55c\" greater than 0x100000\n Virtual size of \".text\" is \"0x403c54\" greater than 0x100000\n Virtual size of \".data\" is \"0x46695c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"InstallSetup5.exe\" (UID: 00000000-00005788) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"InstallSetup5.exe\" (UID: 00000000-00005788) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00004352) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, HOMEPATH, TEMP, USERPROFILE, TMP, NUMBER_OF_PROCESSORS\"\n Process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00004352) was launched with missing environment variables: \"LOGONSERVER, USERDNSDOMAIN\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$48","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00005636.00000001.80515.00210000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00005776.00000001.82813.00300000.00000004.mdmp, 00000000-00005776.00000002.84736.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Broom.exe\" searching for class \"msctls_updown32\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"InstallSetup5.exe\" (UID: 00000000-00005788)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00005964)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00005800)\n Spawned process \"Broom.exe\" (UID: 00000000-00005776)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00006044)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00004352)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"InstallSetup5.exe\" (UID: 00000000-00005788)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00005964)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00005800)\n Spawned process \"Broom.exe\" (UID: 00000000-00005776)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00006044)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00004352)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Broom.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"InstallSetup5.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"toolspub2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DISMHOST.EXE.6A992DEC.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\InstallSetup5.exe\"\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\toolspub2.exe\"\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\31839b57a4f11171d6abc8bbc4451ee4.exe\"\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\latestX.exe\"\n \"InstallSetup5.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Broom.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" connecting to \"\\ThemeApiPort\"\n \"InstallSetup5.exe\" connecting to \"\\ThemeApiPort\"\n \"toolspub2.exe\" connecting to \"\\ThemeApiPort\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" connecting to \"\\ThemeApiPort\"\n \"Broom.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Broom.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 11 sections\"- Location: [%TEMP%\\Broom.exe]- [targetUID: 00000000-00005776]\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 4 sections\"- Location: [%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe]- [targetUID: 00000000-00005800]\n \"InstallSetup5.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections\"- Location: [%TEMP%\\InstallSetup5.exe]- [targetUID: 00000000-00005636]\n \"toolspub2.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 4 sections\"- Location: [%TEMP%\\toolspub2.exe]- [targetUID: 00000000-00006044]\n \"dism.log\" has type \"Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators\"- [targetUID: N/A]\n \"DISMHOST.EXE.6A992DEC.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains a Wine emulator-related string\n Matched sigs: Able to identify virtual/sandbox environment\n Matched sigs: Able to identify virtual/sandbox environment devices\n Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"InstallSetup5.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"InstallSetup5.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"Broom.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Broom.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\installsetup5.exe\"\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\toolspub2.exe\"\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\31839b57a4f11171d6abc8bbc4451ee4.exe\"\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\latestx.exe\"\n \"InstallSetup5.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\broom.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005800)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Disposition: form-data; name=\"%hs\"; filename=\"%ls\"\"; Source: \"00000000-00005776.00000001.82813.70B51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$54","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$55","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Compress data using CryptoPP library","description":"YARA signature for compress data function process \"00000000-00005776\"","origin":"YARA Signature","mitre_attack_id":"T1560.002","relevance":1,"id":"yara-179","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"empty the Recycle Bin on the specified drive\" [Source: Broom.exe]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationA\" (Indicator: \"WTSQuerySessionInformation\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE7ED69AB6B0654AD68DEBC91D4B62]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003116.00000000.90812.00200000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEE31B1B2B913F4B85828137EBC08F]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003116.00000000.90812.00200000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE2A97BAD593D24FD0832F35C5DCB5]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004352.00000000.82248.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003116.00000000.90812.00200000.00000004.mdmp, 00000000-00003116.00000001.91349.0024A000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004352.00000000.82248.002F0000.00000004.mdmp, 00000000-00004352.00000001.82371.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"8159676,5824,3024,,RtlGetVersion,NTDLL.dll,\"252:06:23.739\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00005636.00000000.80120.00210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: toolspub2.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"BFilename=|DataDirectory|aspnetdb.mdf;User Instance=true\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005636.00000000.80120.00210000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: Broom.exe]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" tries to directly access volume data \"C:\"\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" tries to directly access volume data \"Z:\"\n \"InstallSetup5.exe\" tries to directly access volume data \"C:\"\n \"InstallSetup5.exe\" tries to directly access volume data \"Z:\"\n \"Broom.exe\" tries to directly access volume data \"C:\"\n \"Broom.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72CD0000\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\System32\\samlib.dll\" at 73C20000\n \"Broom.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72CD0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$5a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"toolspub2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"Broom.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"Broom.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \".?AV?$GCoConcrete@VGCoCipherAES_CBC@@@@\" (Indicator: \"aes\"; Source: \"00000000-00005776.00000001.82813.70562000.00000004.mdmp\")\n Found string \".?AVGCoCipherAES_CBC@@\" (Indicator: \"aes\"; Source: \"00000000-00005776.00000001.82813.70562000.00000004.mdmp\")\n Found string \".?AV?$GCoConcrete@VGCoCipherAES_CTR@@@@\" (Indicator: \"aes\"; Source: \"00000000-00005776.00000001.82813.70562000.00000004.mdmp\")\n Found string \".?AVGCoCipherAES_CTR@@\" (Indicator: \"aes\"; Source: \"00000000-00005776.00000001.82813.70562000.00000004.mdmp\")\n Found string \".?AV?$GCoConcrete@VGCoCipherPBE_AES_CTR_PBKDF2_SHA1@@@@\" (Indicator: \"aes\"; Source: \"00000000-00005776.00000001.82813.70562000.00000004.mdmp\")\n Found string \".?AVGCoCipherPBE_AES_CTR_PBKDF2_SHA1@@\" (Indicator: \"aes\"; Source: \"00000000-00005776.00000001.82813.70562000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: Broom.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found reference to API \"getLookupAccountName\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00005776.00000001.82813.70B51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003116.00000000.90812.00BF1000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003116.00000000.90812.00BF1000.00000020.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003116.00000000.90812.00BF1000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005776.00000000.80890.00822000.00000004.mdmp, 00000000-00005776.00000002.84736.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003116.00000000.90812.00BF1000.00000020.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005776.00000001.82813.70B51000.00000020.mdmp, 00000000-00005776.00000001.82813.70D1A000.00000002.mdmp, 00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70B44000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")\n Found reference to API \"(BOOL)g_pfnGetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005776.00000001.82813.70B51000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"p_DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003116.00000000.90812.00BF1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Broom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinA\" (File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found string \"SHEmptyRecycleBinA\" (Source: \"00000000-00005776.00000000.80890.0081E000.00000004.mdmp, 00000000-00005776.00000002.84736.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in file \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00005776.00000000.80890.00822000.00000004.mdmp, 00000000-00005776.00000002.84736.00822000.00000004.mdmp, 00000000-00005776.00000002.84736.70DC1000.00000020.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\"\n Found registry deletion API: \"SHDeleteKeyW\" in \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\"\n Found registry deletion API: \"SHDeleteValueW\" in \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\tzres.dll\" (UID: 00000000-00005800)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Broom.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: InstallSetup5.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"00000000-00005964.00000000.80611.00401000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005776.00000001.82813.70C9A000.00000004.mdmp, 00000000-00005776.00000002.84736.70B44000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\" (Indicator: \"{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\") in Source: 00000000-00005776.00000001.82813.00300000.00000004.mdmp\n 00000000-00005776.00000002.84736.00300000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$64","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" opened \"\\Device\\KsecDD\"\n \"InstallSetup5.exe\" opened \"\\Device\\KsecDD\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" opened \"\\Device\\KsecDD\"\n \"Broom.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$65","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$66","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"lsass.exe,lsm.exe,svchost.exe,spoolsv.exe,smss.exe\" (Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00005776.00000001.82813.70DD8000.00000002.mdmp, 00000000-00005776.00000002.84736.70BB9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Broom.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 11 sections\"- Location: [%TEMP%\\Broom.exe]- [targetUID: 00000000-00005776]\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 4 sections\"- Location: [%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe]- [targetUID: 00000000-00005800]\n \"InstallSetup5.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections\"- Location: [%TEMP%\\InstallSetup5.exe]- [targetUID: 00000000-00005636]\n \"toolspub2.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 4 sections\"- Location: [%TEMP%\\toolspub2.exe]- [targetUID: 00000000-00006044]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"Broom.exe\" was detected as \"Borland Delphi 4.0\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"toolspub2.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"DISMHOST.EXE.6A992DEC.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Broom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".text\" unusually large (12812116 bytes)\n possible junk padding\n Section \".data\" has very low entropy (0.81)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" at 00000000-00005800-00000105-11959586\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" at 00000000-00004352-00000105-4558536","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c\" has section name .text with entropy \"7.953193373552023\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has section name .text with entropy \"7.9990665015204705\"\n \"InstallSetup5.exe\" has section name .rsrc with entropy \"7.4500717937657255\"\n \"toolspub2.exe\" has section name .text with entropy \"7.574987681840815\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe\" has high entropy 7.96753\n Dropped file \"%TEMP%\\InstallSetup5.exe\" has high entropy 7.99646","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/27 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"Broom.exe\" has resource with unusual entropy \"VCLSTYLE:7.955538924242702\"\n \"Broom.exe\" has resource with unusual entropy \"RT_BITMAP:7.204507547582926\"\n \"Broom.exe\" has resource with unusual entropy \"RT_RCDATA:7.886367032655639\"\n \"Broom.exe\" has resource with unusual entropy \"RT_RCDATA:7.58418098582544\"\n \"Broom.exe\" has resource with unusual entropy \"RT_RCDATA:7.808588808062177\"\n \"Broom.exe\" has resource with unusual entropy \"RT_RCDATA:7.758325192927498\"\n \"Broom.exe\" has resource with unusual entropy \"RT_RCDATA:7.5191733345079514\"\n \"Broom.exe\" has resource with unusual entropy \"RT_RCDATA:7.665567395404698\"\n \"Broom.exe\" has resource with unusual entropy \"RT_RCDATA:7.631838602120624\"\n \"InstallSetup5.exe\" has resource with unusual entropy \"RT_ICON:7.948570129704542\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Broom.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 11 sections\"- Location: [%TEMP%\\Broom.exe]- [targetUID: 00000000-00005776]\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 4 sections\"- Location: [%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe]- [targetUID: 00000000-00005800]\n \"InstallSetup5.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections\"- Location: [%TEMP%\\InstallSetup5.exe]- [targetUID: 00000000-00005636]\n \"toolspub2.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 4 sections\"- Location: [%TEMP%\\toolspub2.exe]- [targetUID: 00000000-00006044]\n \"DISMHOST.EXE.6A992DEC.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$68","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"Network Related","name":"Contains Tor Onion URL","description":"\"http://k55dcgrv6gal6rwa2h4q3s4pg7gdtgtla2vkzi3zx3ikiqipz2uxuoid.onion\" (Indicator: \".onion\") in Source: 00000000-00004352.00000001.82371.0B400000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1090.003","relevance":1,"id":"string-176","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE process \"00000000-00006044\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WbemScripting.SWbemLocator\" (Indicator: \"wbemscripting.\"; in Source: \"00000000-00004352.00000000.82248.002F0000.00000004.mdmp, 00000000-00004352.00000000.82248.0B480000.00000004.mdmp, 00000000-00004352.00000001.82371.002F0000.00000004.mdmp, 00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"\\\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00004352.00000001.82371.002F0000.00000004.mdmp\")\n Found string \"root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00004352.00000001.82371.002F0000.00000004.mdmp\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")\n Found string \"wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00004352.00000001.82371.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"InstallSetup5.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsc25B8.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"InstallSetup5.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsc25B8.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" claimed CRC 4379602 while the actual is CRC 4375724\n \"DISMHOST.EXE.6A992DEC.bin\" claimed CRC 285116 while the actual is CRC 103114","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$69","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"toolspub2.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\toolspub2.exe\"\" - (UID: 00000000-00005964)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 73 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/27 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 3)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"15/27 Antivirus vendors marked dropped file \"31839b57a4f11171d6abc8bbc4451ee4.exe\" as malicious (classified as \"Kryptik.LCI.gen\" with 55% detection rate)\n 12/27 Antivirus vendors marked dropped file \"toolspub2.exe\" as malicious (classified as \"Gen:Variant.Jaik\" with 44% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"12/27 Antivirus vendors marked spawned process \"toolspub2.exe\" (PID: 5964) as malicious (classified as \"Gen:Variant.Jaik\" with 44% detection rate)\n 15/27 Antivirus vendors marked spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (PID: 5800) as malicious (classified as \"Kryptik.LCI.gen\" with 55% detection rate)\n 12/27 Antivirus vendors marked spawned process \"toolspub2.exe\" (PID: 6044) as malicious (classified as \"Gen:Variant.Jaik\" with 44% detection rate)\n 15/27 Antivirus vendors marked spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (PID: 4352) as malicious (classified as \"Kryptik.LCI.gen\" with 55% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_DLInjector04\" matched file \"sample.bin\" as \"Detects downloader / injector\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c.exe\" (UID: 00000000-00005636)\n Spawned process \"InstallSetup5.exe\" (UID: 00000000-00005788)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00005964)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00005800)\n Spawned process \"Broom.exe\" (UID: 00000000-00005776)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00006044)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00004352)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"00000000-00007556.00000000.67337.00401000.00000020.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"00000000-00007556.00000000.67337.00401000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001936.00000002.71153.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"brandrock.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"brandrock.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 57243-1801-00409C01\n SetUnhandledExceptionFilter@KERNEL32.dll at 59597-1125-00407B85\n SetUnhandledExceptionFilter@KERNEL32.dll at 59597-27059-00408766","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$6a","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"brandrock.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007408.00000001.69373.03660000.00000004.mdmp, 00000000-00007408.00000002.71293.03660000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00007556.00000000.67337.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"31839b57a4f11171d6abc8bbc4451ee4.exe.1261731743\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007408.00000000.67452.00822000.00000004.mdmp, 00000000-00007408.00000002.71293.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"00000000-00007556.00000000.67337.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001936.00000002.71153.00408000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001936.00000002.71153.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"00000000-00007556.00000000.67337.00401000.00000020.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00001936.00000002.71153.00408000.00000002.mdmp\")\n Found reference to API \"WTSRegisterSessionNotification\" (Indicator: \"WTSRegisterSessionNotification\"; Source: \"00000000-00007408.00000000.67452.00822000.00000004.mdmp, 00000000-00007408.00000002.71293.00822000.00000004.mdmp\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00007408.00000000.67452.00822000.00000004.mdmp, 00000000-00007408.00000002.71293.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00007556.00000000.67337.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; File: \"31839b57a4f11171d6abc8bbc4451ee4.exe.1261731743\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007408.00000000.67452.00822000.00000004.mdmp, 00000000-00007408.00000002.71293.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00001936.00000002.71153.0040A000.00000004.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00007408.00000002.71293.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains the ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameA\" (Indicator: \"GetVolumePathName\"; File: \"00000000-00007556.00000000.67337.00401000.00000020.mdmp\")\n Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"31839b57a4f11171d6abc8bbc4451ee4.exe.1261731743\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00007476-00000C15-64235981","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$6b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$6c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"powershell.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007476)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00002500)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133448319924261219.7476.DefaultAppDomain.powershell\" - (UID: 00000000-00007476)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00006212)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001936.00000002.71153.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001936.00000002.71153.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"brandrock.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 733C0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: brandrock.exe, Indicator: \"select * from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00002500-00000C41-40571364898]\n Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00000812-00000BC0-77585704]\n Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00000812-00000BC0-78688039]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00007476-00000BC0-63200456]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"Broom.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 1308","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"brandrock.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"Broom.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$6e","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"latestX.exe\" touched file \"C:\\Program Files\\Google\\Chrome\\updater.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"brandrock.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\brandrock.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /raw/cZ2J3Upi HTTP/1.1Accept: */*\n Connection: close\n Host: pastebin.com\n User-Agent: cpp-httplib/0.9\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://pastebin.com/raw/cZ2J3Upi\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$6f","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007476)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007656)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007476)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$70","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00001936.00000002.71153.00408000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00001936.00000002.71153.00408000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00001936.00000002.71153.00408000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00001936.00000002.71153.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00007408.00000002.71293.0081D000.00000004.mdmp\")\n Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; Source: \"00000000-00007408.00000002.71293.0081D000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007408.00000002.71293.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"00000000-00007556.00000000.67337.00401000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"00000000-00007556.00000000.67337.00401000.00000020.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001936.00000002.71153.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: toolspub2.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00001936.00000002.71153.00408000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001936.00000002.71153.00408000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001936.00000002.71153.0040A000.00000004.mdmp\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00007408.00000000.67452.00822000.00000004.mdmp, 00000000-00007408.00000002.71293.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"latestX.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"D06725BF8A1ADA0100000000000000000000000002000000\")\n \"latestX.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"00DD3ABF8A1ADA0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"brandrock.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\brandrock.exe.log]- [targetUID: 00000000-00001380]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"#c:\\windows\\system32\\licensingui.exe\" (Indicator: \"licensingui.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .text\n .rsrc\n .text with unusual entropies 7.95319337355\n 7.99906650152\n 7.45007179377\n 7.57498768184","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 59597-5108-0049DBB5\n rdtsc at 59597-27475-006E56AD\n rdtsc at 59597-24695-007A7DC1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 57243-972-0040C41C\n cpuid at 59597-19960-006EBDE3\n cpuid at 59597-2909-004493E6\n cpuid at 59597-17502-006891DC\n cpuid at 59597-1179-00409154\n cpuid at 59597-15336-006334A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.dll at 57243-961-0040CFF9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.dll at 57243-1-004052A9\n GetStartupInfoW@KERNEL32.dll at 59597-1-0040510C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"13/90 reputation engines marked \"https://filesdumpplace.org\" as malicious (14% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"Environment Awareness","name":"Found a Wine emulator related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","relevance":2,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"Broom.exe\" sets a callback procedure (5f8e78) using filter \"WH_CBT\" for process ID: 1cf0","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"toolspub2.exe\" set thread context in remote process \"%TEMP%\\toolspub2.exe\" (PID: 1cdc)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$72","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"http://api.ipify.org/?format=weg\" (Indicator: \"api.ipify.org\"; File: \"00000000-00001936.00000000.67315.02BC0000.00000004.mdmp, 00000000-00001936.00000002.71153.02BC0000.00000004.mdmp\")\n \"https://iplogger.com/1aiQK4\" (Indicator: \"iplogger.com\"; File: \"00000000-00001936.00000000.67315.02BC0000.00000004.mdmp, 00000000-00001936.00000002.71153.02BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"Network Related","name":"Writes to the hosts file","description":"\"latestX.exe\" wrote 2748 bytes to file \"C:\\Windows\\System32\\drivers\\etc\\hosts\": 2320436f707972696768742028632920313939332d32303039204d6963726f736f667420436f72702e0d0a230d0a23205468697320697320612073616d706c6520484f5354532066696c652075736564206279204d6963726f736f6674205443502f495020666f722057696e646f77732e0d0a230d0a2320546869732066696c ...\n \"latestX.exe\" wrote to file \"%WINDIR%\\System32\\drivers\\etc\\hosts\"","origin":"API Call","mitre_attack_id":"T1565","relevance":10,"id":"api-32","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$73","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]}],"intel_graph":{"map":{"File:2a2a9be55b1e635fe289f27c8ab8bbc2486f79f83aec8adcc85ad65c3d1b2db8":{"type":"File","value":"2a2a9be55b1e635fe289f27c8ab8bbc2486f79f83aec8adcc85ad65c3d1b2db8"},"File:37378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe":{"type":"File","value":"37378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe"},"File:377105f73402f4147ae87a6432ead4892202e4392991d8d70f8073608c1a46f4":{"type":"File","value":"377105f73402f4147ae87a6432ead4892202e4392991d8d70f8073608c1a46f4"},"File:3f15965d0159a818849134b3fbb016e858ac50efdf67bfcd762606ac51831bc5":{"type":"File","value":"3f15965d0159a818849134b3fbb016e858ac50efdf67bfcd762606ac51831bc5"},"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c":{"type":"File","value":"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as packed by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat SmokeLoader"]}},"File:b528a693370e4564869ca6268d57b3fc415c4015f5daa414e59e7adf308ff74b":{"type":"File","value":"b528a693370e4564869ca6268d57b3fc415c4015f5daa414e59e7adf308ff74b"},"File:c3881f5305c8dbd3bd81f01994ed179e3d0c2b3c963a9a509e236179d7a3308e":{"type":"File","value":"c3881f5305c8dbd3bd81f01994ed179e3d0c2b3c963a9a509e236179d7a3308e"},"File:cf83752d5ae453dafb33548ca0cae2ec5489219283929f783ee654acbd3946ab":{"type":"File","value":"cf83752d5ae453dafb33548ca0cae2ec5489219283929f783ee654acbd3946ab"},"File:d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d":{"type":"File","value":"d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"Threat:ada9ac3ecf1aea7a80d89fa364bc17118165a13672a8093fe8ddd6109d5d9133":{"type":"Threat","value":"SmokeLoader","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1544894128658769429","root":"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as packed by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat SmokeLoader"]}},{"id":"1544894121570857538","root":"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","to_key":"Threat:ada9ac3ecf1aea7a80d89fa364bc17118165a13672a8093fe8ddd6109d5d9133"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_files","root":"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","edges":[{"edge_kind":"extracted","from_key":"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","to_key":"File:37378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe"},{"edge_kind":"extracted","from_key":"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","to_key":"File:377105f73402f4147ae87a6432ead4892202e4392991d8d70f8073608c1a46f4"},{"edge_kind":"extracted","from_key":"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","to_key":"File:cf83752d5ae453dafb33548ca0cae2ec5489219283929f783ee654acbd3946ab"},{"edge_kind":"extracted","from_key":"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","to_key":"File:c3881f5305c8dbd3bd81f01994ed179e3d0c2b3c963a9a509e236179d7a3308e"},{"edge_kind":"extracted","from_key":"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","to_key":"File:2a2a9be55b1e635fe289f27c8ab8bbc2486f79f83aec8adcc85ad65c3d1b2db8"},{"edge_kind":"extracted","from_key":"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","to_key":"File:b528a693370e4564869ca6268d57b3fc415c4015f5daa414e59e7adf308ff74b"},{"edge_kind":"extracted","from_key":"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","to_key":"File:d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d"},{"edge_kind":"extracted","from_key":"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","to_key":"File:b528a693370e4564869ca6268d57b3fc415c4015f5daa414e59e7adf308ff74b"},{"edge_kind":"extracted","from_key":"File:8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","to_key":"File:3f15965d0159a818849134b3fbb016e858ac50efdf67bfcd762606ac51831bc5"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":16,"spawned_processes_count":16,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":19,"imported_dlls_count":198,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":21,"files_deleted_count":0,"registry_keys_created_count":20,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":20,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["urlscanio","commodity","criminal","smokeloader","downloader","evasive","pua","windows-server-utility"],"sample_flags":["Multi-Process","Extracted Files","User Comment","Sample Crashed"],"sandbox_reports":[{"id":"6a98d8c0a94c130c0a096747","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"IL:Trojan.ClipBanker","submit_name":"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","analysis_start_time":"2026-09-03T02:17:39+00:00","indicators_count":{"informative":250,"suspicious":40,"malicious":9},"tags":["Multi-Process","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"6558f7d853b33723ae08ea0a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"IL:Trojan.MSILZilla","submit_name":"brandrock.exe","analysis_start_time":"2023-11-18T17:43:53+00:00","indicators_count":{"informative":188,"suspicious":55,"malicious":14},"tags":["Multi-Process","Extracted Files","Sample Crashed","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}],"processes":[{"pid":1380,"ppid":0,"name":"brandrock.exe","command_line":"","sha256":"8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c","normalized_path":"C:\\brandrock.exe","uid":"00000000-00001380","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":1936,"ppid":1380,"name":"InstallSetup5.exe","command_line":"","sha256":"377105f73402f4147ae87a6432ead4892202e4392991d8d70f8073608c1a46f4","normalized_path":"%TEMP%\\InstallSetup5.exe","parent_uid":"00000000-00001380","uid":"00000000-00001936"},{"pid":7408,"ppid":1936,"name":"Broom.exe","command_line":"","sha256":"ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504","normalized_path":"%TEMP%\\Broom.exe","parent_uid":"00000000-00001936","uid":"00000000-00007408"},{"pid":7556,"ppid":1380,"name":"toolspub2.exe","command_line":"","sha256":"cf83752d5ae453dafb33548ca0cae2ec5489219283929f783ee654acbd3946ab","normalized_path":"%TEMP%\\toolspub2.exe","parent_uid":"00000000-00001380","uid":"00000000-00007556"},{"pid":7388,"ppid":7556,"name":"toolspub2.exe","command_line":"","sha256":"cf83752d5ae453dafb33548ca0cae2ec5489219283929f783ee654acbd3946ab","normalized_path":"%TEMP%\\toolspub2.exe","parent_uid":"00000000-00007556","uid":"00000000-00007388"},{"pid":2500,"ppid":1380,"name":"31839b57a4f11171d6abc8bbc4451ee4.exe","command_line":"","sha256":"37378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe","normalized_path":"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe","parent_uid":"00000000-00001380","uid":"00000000-00002500"},{"pid":7476,"ppid":2500,"name":"powershell.exe","command_line":"powershell -nologo -noprofile","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00002500","uid":"00000000-00007476"},{"pid":2524,"ppid":7476,"name":"WerFault.exe","command_line":"-u -p 7476 -s 2540","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007476","uid":"00000000-00002524"},{"pid":1428,"ppid":7476,"name":"WerFault.exe","command_line":"-u -p 7476 -s 2540","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007476","uid":"00000000-00001428"},{"pid":6212,"ppid":2500,"name":"31839b57a4f11171d6abc8bbc4451ee4.exe","command_line":"","sha256":"37378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe","normalized_path":"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe","parent_uid":"00000000-00002500","uid":"00000000-00006212"},{"pid":7656,"ppid":6212,"name":"powershell.exe","command_line":"powershell -nologo -noprofile","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006212","uid":"00000000-00007656"},{"pid":6052,"ppid":7656,"name":"WerFault.exe","command_line":"-u -p 7656 -s 1212","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007656","uid":"00000000-00006052"},{"pid":4188,"ppid":7656,"name":"WerFault.exe","command_line":"-u -p 7656 -s 1212","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007656","uid":"00000000-00004188"},{"pid":812,"ppid":1380,"name":"latestX.exe","command_line":"","sha256":"f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87","normalized_path":"%TEMP%\\latestX.exe","parent_uid":"00000000-00001380","uid":"00000000-00000812"},{"pid":4272,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 464 -p 7476 -ip 7476","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004272","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6512,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 464 -p 7656 -ip 7656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006512","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["vcruntime140_clr0400.dll","shell32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","samcli.dll","api-ms-win-core-synch-l1-2-0.dll","IconCodecService.dll","winhttp.dll","wbemsvc.dll","ntdll.dll","api-ms-win-crt-math-l1-1-0.dll","psapi.dll","clbcatq.dll","secur32.dll","ATL90.dll","powrprof.dll","api-ms-win-crt-locale-l1-1-0.dll","iertutil.dll","lpk.dll","shfolder.dll","wmiutils.dll","msvcp140.dll","shdocvw.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","rsaenh.dll","kernel32.dll","oleaccrc.dll","GrooveIntlResource.dll","fastprox.dll","oleaut32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","rpcss.dll","WindowsCodecs.dll","Telemetry.dll","imageres.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","winsta.dll","cryptsp.dll","ntdsapi.dll","vcruntime140.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-xstate-l2-1-0.dll","wtsapi32.dll","api-ms-win-crt-time-l1-1-0.dll","netutils.dll","msvcp110.dll","msimg32.dll","mscorlib.ni.dll","cryptbase.dll","uxtheme.dll","colorui.dll","KernelBase.dll","usp10.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","msvcr90.dll","wshqos.dll","wbemprox.dll","msvcr110.dll","wsock32.dll","msctf.dll","ntmarta.dll","diasymreader.dll","netapi32.dll","System.Core.ni.dll","xmllite.dll","bcrypt.dll","api-ms-win-core-file-l2-1-0.dll","ole32.dll","sspicli.dll","dwmapi.dll","mscms.dll","tzres.dll","api-ms-win-core-file-l1-2-0.dll","mscoree.dll","user32.dll","INETRES.dll","GROOVEEX.DLL","WSHTCPIP.DLL","mscoreei.dll","clr.dll","System.ni.dll","devobj.dll","rpcrt4.dll","cfgmgr32.dll","userenv.dll","webio.dll","ucrtbase_clr0400.dll","comdlg32.dll","VxSSL32.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","winmm.dll","wbemcomn.dll","setupapi.dll","srvcli.dll","api-ms-win-crt-environment-l1-1-0.dll","imm32.dll","shlwapi.dll","urlmon.dll","LoggingPlatform.dll","samlib.dll","sechost.dll","mscorrc.dll","normaliz.dll","FileSyncShell.dll","api-ms-win-crt-convert-l1-1-0.dll","GdiPlus.dll","wbemdisp.dll","advapi32.dll","version.dll","profapi.dll","EhStorShell.dll","msvcr100.dll","wbemcomn2.dll","cabinet.dll","msvcrt.dll","api-ms-win-crt-string-l1-1-0.dll","propsys.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","msvcp90.dll","RpcRtRemote.dll","nsi.dll","api-ms-win-core-processthreads-l1-1-1.dll","Wldap32.dll","compstui.dll","gdi32.dll","ucrtbase.dll","clrjit.dll","comctl32.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","apphelp.dll","oleacc.dll","wkscli.dll","fltLib.dll","ws2_32.dll","wininet.dll","wship6.dll","sxs.dll","atl.dll","slc.dll","TextInputFramework.dll","Microsoft.AppV.AppvClientComConsumer.dll","System.Xml.ni.dll","windows.storage.dll","wshext.dll","OpcServices.dll","wintrust.dll","System.Management.dll","bcryptprimitives.dll","System.Configuration.ni.dll","Microsoft.AppV.AppVClientPowerShell.dll","winmmbase.dll","System.Management.Automation.dll","System.Data.dll","Microsoft.Management.Infrastructure.ni.dll","crypt32.dll","wow64win.dll","Microsoft.PowerShell.ConsoleHost.dll","MpClient.dll","VxSSL64.dll","cryptnet.dll","Microsoft.Management.Infrastructure.Native.dll","amsi.dll","System.DirectoryServices.dll","edputil.dll","cldapi.dll","coml2.dll","win32u.dll","wow64cpu.dll","SHCore.dll","imagehlp.dll","msIso.dll","System.Numerics.dll","pwrshsip.dll","gdi32full.dll","CoreUIComponents.dll","wldp.dll","Windows.StateRepositoryPS.dll","kernel.appcore.dll","msasn1.dll","combase.dll","msisip.dll","wow64.dll","IPHLPAPI.DLL","Microsoft.PowerShell.Security.dll","CoreMessaging.dll","WinTypes.dll","winnsi.dll","msvcp_win.dll","aepic.dll","policymanager.dll","MpOAV.dll","System.Transactions.dll","sppc.dll","AppxSip.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"31839b57a4f11171d6abc8bbc4451ee4.exe","sha256":"37378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"InstallSetup5.exe","sha256":"377105f73402f4147ae87a6432ead4892202e4392991d8d70f8073608c1a46f4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"toolspub2.exe","sha256":"cf83752d5ae453dafb33548ca0cae2ec5489219283929f783ee654acbd3946ab","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"Broom.exe","sha256":"c3881f5305c8dbd3bd81f01994ed179e3d0c2b3c963a9a509e236179d7a3308e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"DISMHOST.EXE.6A992DEC.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"name":"dism.log","sha256":"2a2a9be55b1e635fe289f27c8ab8bbc2486f79f83aec8adcc85ad65c3d1b2db8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"name":"updater.exe","sha256":"b528a693370e4564869ca6268d57b3fc415c4015f5daa414e59e7adf308ff74b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"brandrock.exe.log","sha256":"d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"latestX.exe","sha256":"b528a693370e4564869ca6268d57b3fc415c4015f5daa414e59e7adf308ff74b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"hosts","sha256":"3f15965d0159a818849134b3fbb016e858ac50efdf67bfcd762606ac51831bc5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]}],"files_written":[{"path":"%TEMP%\\InstallSetup5.exe","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"},{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"path":"%TEMP%\\toolspub2.exe","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"path":"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"path":"%TEMP%\\latestX.exe","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"path":"%TEMP%\\nsc25B8.tmp","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"path":"%TEMP%\\Broom.exe","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\brandrock.exe.log","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"path":"%SAMPLEDIR%\\Windows","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"path":"%WINDIR%\\System32\\drivers","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"path":"%WINDIR%\\System32\\drivers\\etc","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"path":"%WINDIR%\\System32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"path":"%PROGRAMFILES%\\Google\\Chrome\\updater.exe","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a98d8c0a94c130c0a096747"}]},{"name":"Local\\SM0:1380:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"SM0:1380:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"Local\\SM0:1380:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"SM0:1380:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"Local\\SM0:1936:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"SM0:1936:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"SM0:2500:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"Local\\SM0:7408:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"Local\\SM0:7476:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"SM0:7476:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"SM0:7476:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"SM0:6212:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"SM0:7656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]},{"name":"Local\\SM0:7656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6558f7d853b33723ae08ea0a"}]}]}},"report_ids":{"sandbox_job_ids":["6558f7d853b33723ae08ea0a","6a98d8c0a94c130c0a096747"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious IL:Trojan.ClipBanker Sample 8817cbb6de14… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8817cbb6de14…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 18/28 AV engines flagged this file. 19 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c"}],["$","meta","4",{"property":"og:title","content":"Malicious IL:Trojan.ClipBanker Sample 8817cbb6de14… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8817cbb6de14…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 18/28 AV engines flagged this file. 19 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8817cbb6de1446a920401a072df1453459aa95684ffc7da9c05ca759b1836c0c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious IL:Trojan.ClipBanker Sample 8817cbb6de14… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8817cbb6de14…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 18/28 AV engines flagged this file. 19 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L74","11",{}]]