21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 65:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 899ce99aa7fd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 899ce99aa7fd…. Malware family: Trojan.Generic. Threat score 100/100. 10/26 AV engines flagged this file. 11 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/899ce99aa7fda10c1b37b29f2353d3fd9f91e4119292bd437ab6a8c5066cafa0","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","899ce99aa7fda10c1b37b29f2353d3fd9f91e4119292bd437ab6a8c5066cafa0"],"about":{"@type":"SoftwareApplication","name":"cac213f52f629a3b514dfbe6f6aed65f.exe","applicationCategory":["peexe","executable"],"identifier":"899ce99aa7fda10c1b37b29f2353d3fd9f91e4119292bd437ab6a8c5066cafa0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":26},"behavioralIndicators":{"malicious":11,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAMwAAAGAAAAAAAAAAAAAAADMAAAAAZkAAAAAAAAAAAAAAAABm6IjuiIcAAAAAAAAAB3d+iP//+I7vgAAAAAB4iP/4iP//////jocAAAAI////iP/////4iPjoAAACf//4iI//////hY3/jmAAAo+IiHj//////4j3j/jgAAf4iIh/////////83/45gAI+IiHj////4iI/////44AD/iIh/////ZmZuj///+OYA/4iHj///9mMAAGj4iP/mAP+Ih4j//4Z3cABo+IePhgD/h4iIiI92dwAARvZmj4YA/3WIhmZod3cAd3b2Zo92AP93+Id4j4d3d3dm+Ij/ZgD/ePj///+Gd3d3aP//+GQA/4j4/////nd3dn////hgAP94+I/////md2j////2YAD4j/+P/////4j/////h3AA+I//j////////////2dwAIiP//j///////////hkAAAIj/////////////+GgAAAiIgn//j////////45oAAAP+IiP+Aj//////4jofwAAD/iIiIh4+I+Hd4jniIgAAA//+IaP///4iIiId4f3AAAP///4///3/////4h/cAAACP//////go//iIiI9wAAAAf/////+IiIiIiIhwAAAAAAeIiIiIiIh3cAAAAAAAAAAAB3d3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==23:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAMwAAAGAAAAAAAAAAAAAAADMAAAAAZkAAAAAAAAAAAAAAAABm6IjuiIcAAAAAAAAAB3d+iP//+I7vgAAAAAB4iP/4iP//////jocAAAAI////iP/////4iPjoAAACf//4iI//////hY3/jmAAAo+IiHj//////4j3j/jgAAf4iIh/////////83/45gAI+IiHj////4iI/////44AD/iIh/////ZmZuj///+OYA/4iHj///9mMAAGj4iP/mAP+Ih4j//4Z3cABo+IePhgD/h4iIiI92dwAARvZmj4YA/3WIhmZod3cAd3b2Zo92AP93+Id4j4d3d3dm+Ij/ZgD/ePj///+Gd3d3aP//+GQA/4j4/////nd3dn////hgAP94+I/////md2j////2YAD4j/+P/////4j/////h3AA+I//j////////////2dwAIiP//j///////////hkAAAIj/////////////+GgAAAiIgn//j////////45oAAAP+IiP+Aj//////4jofwAAD/iIiIh4+I+Hd4jniIgAAA//+IaP///4iIiId4f3AAAP///4///3/////4h/cAAACP//////go//iIiI9wAAAAf/////+IiIiIiIhwAAAAAAeIiIiIiIh3cAAAAAAAAAAAB3d3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==24:T1964,"cac213f52f629a3b514dfbe6f6aed65f.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000a8cc390038cf14770c368f0214cd390001000000c0358f020c368f02c0358f02040000000400000000e03d760010000014cd390001000000c0358f02cd9714779c97147775200e2fb50f3476c0358f020000147700000000e41504760000000080ee3a760100000000000000f8e23d76000000000400000080a9a97348403c76f8e23d7618cd390080e8d2750812900280e8d27514cd39000000000080e8d27500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ae0d8f02c40d8f02 (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b62b9202ce2b9202 (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004e46920262469202 (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006e4b9202864b9202 (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006e4b9202844b9202 (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007484) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008020) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008020)25:T2d55,"cac213f52f629a3b514dfbe6f6aed65f.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "LoadLibrary" with a parameter SHFOLDER (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "LoadLibrary" with a parameter RichEd20 (UID: 00000000-00007484) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008020) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008020) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008020) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008020) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000752) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000752) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000752) "tasklist.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000752) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00000752) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005364) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005364) "tasklist.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005364) "tasklist.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005364) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00005364) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003864) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003864) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003864) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003864) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000208) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000208) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000208) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000208) "Solved.com" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006608) "Solved.com" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006608) "Solved.com" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006608) "Solved.com" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006608) "Solved.com" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006608) "Solved.com" called "LoadLibrary" with a parameter %TEMP%\87966\n (UID: 00000000-00006608) "Solved.com" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00006608) "Solved.com" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006608) "Solved.com" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006608) "Solved.com" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006608) "Solved.com" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006608) "Solved.com" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006608) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000268) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000268) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000268) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000268) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\crypt32 (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter crypt32 (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003344) "RegAsm.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003344)26:T443,"Software\Microsoft\Windows\CurrentVersion" in Source: cac213f52f629a3b514dfbe6f6aed65f.exe "\Opera Software\" in Source: 00000000-00003344-00000CB8-1743954879 "HKEY_CLASSES_ROOT\Record\" in Source: 00000000-00003344.00000002.173073.00932000.00000002.mdmp "HKEY_CLASSES_ROOT\" in Source: 00000000-00003344.00000002.173073.00932000.00000002.mdmp "HKEY_CLASSES_ROOT\CLSID\" in Source: 00000000-00003344.00000002.173073.00932000.00000002.mdmp "HKEY_CLASSES_ROOT\TypeLib\" in Source: 00000000-00003344.00000002.173073.00932000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006608.00000000.165120.07080000.00000004.mdmp 00000000-00006608.00000001.167043.07080000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00006608.00000002.168963.00A0D000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00006608.00000002.168963.00A0D000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00006608.00000002.168963.00A0D000.00000002.mdmp27:T170d2,Found reference to API (Indicator: "RegDeleteKeyW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RegCloseKey"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RegEnumKeyW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DeleteObject"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SelectObject"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GlobalFree"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetErrorMode"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CloseHandle"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "lstrcpynW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "lstrcpynA"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "lstrcpyW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetTickCount"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "MulDiv"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetFileSize"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetVersion"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateFileW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ReadFile"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "lstrlenW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateThread"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WriteFile"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetTempPathW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "MoveFileW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetFilePointer"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetProcAddress"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GlobalLock"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "lstrlenA"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "lstrcmpW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FindNextFileW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FreeLibrary"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetVersionExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetLastError"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DeleteFileW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CompareFileTime"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ExitProcess"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "OpenProcess"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "lstrcpyA"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FindClose"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetFileTime"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateProcessW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "lstrcatW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SearchPathW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CopyFileW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "Sleep"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SHFileOperationW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DestroyWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetClipboardData"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "wsprintfW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "OpenClipboard"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CharNextA"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FillRect"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RegisterClassW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetCursor"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ScreenToClient"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CloseClipboard"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetSysColor"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CharUpperW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CharPrevW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetTimer"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InvalidateRect"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "IsWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "LoadCursorW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "PeekMessageW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ShowWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "wsprintfA"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CharNextW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetDC"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetWindowRect"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "LoadImageW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "BeginPaint"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "AppendMenuW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetWindowPos"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetClientRect"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "EnableWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "OleUninitialize"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "OleInitialize"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "MoveFileExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "Module32NextW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "Module32FirstW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "Process32NextW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "Process32FirstW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "EnumProcessModules"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "EnumProcesses"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateProcessWithLogonW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CopySid"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InitializeAcl"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "OpenThreadToken"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "LogonUserW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetAce"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetUserNameW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetAclInformation"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "AddAce"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetLengthSid"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DuplicateTokenEx"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RegConnectRegistryW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateProcessAsUserW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FreeSid"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RegEnumKeyExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetOpenFileNameW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetSaveFileNameW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DeleteDC"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "StretchBlt"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetObjectW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetDIBits"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RoundRect"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetStockObject"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "IcmpSendEcho"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetProcessId"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "TlsFree"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "HeapFree"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetSystemPowerState"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ResumeThread"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "TerminateThread"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WritePrivateProfileSectionW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetACP"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetStdHandle"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetFileType"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetOEMCP"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateHardLinkW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SizeofResource"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreatePipe"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "HeapAlloc"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DecodePointer"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetStdHandle"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CopyFileExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "TlsSetValue"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "LoadResource"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "VirtualFreeEx"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "TerminateProcess"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetPrivateProfileSectionNamesW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "LCMapStringW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RaiseException"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ExitThread"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetLocalTime"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FormatMessageW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "EncodePointer"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetPriorityClass"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateEventW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "VirtualFree"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetComputerNameW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetVolumeLabelW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetVolumeInformationW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetLongPathNameW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "IsWow64Process"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetProcessIoCounters"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "LockResource"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetPrivateProfileSectionW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CompareStringW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ResetEvent"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RtlUnwind"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetCPInfo"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetLastError"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "TlsGetValue"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FindResourceExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "HeapSize"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetEvent"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "TlsAlloc"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WNetGetConnectionW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WNetUseConnectionW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WNetCancelConnection2W"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WNetAddConnection2W"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SysAllocString"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "VariantChangeType"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SysFreeString"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "VariantCopy"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "VariantClear"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "VariantCopyInd"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SysStringLen"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SafeArrayAccessData"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "VariantInit"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetProcessMemoryInfo"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SHGetDesktopFolder"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CopyImage"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RegisterHotKey"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "IsCharAlphaW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CheckMenuRadioItem"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CloseWindowStation"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetFocus"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetMenuItemID"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CloseDesktop"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ClientToScreen"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetWindowDC"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "AttachThreadInput"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "IsCharUpperW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "IsIconic"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CharLowerBuffW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DestroyIcon"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ReleaseDC"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "IsZoomed"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetMenu"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "RedrawWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetCapture"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetMenuItemCount"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "MessageBoxW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "MessageBeep"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetClipboardData"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "LoadIconW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetKeyState"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "LoadStringW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CopyRect"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InsertMenuItemW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "IsCharAlphaNumericW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "OpenDesktopW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SendInput"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "KillTimer"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DrawFrameControl"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateMenu"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetCursorInfo"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetCursorPos"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetMenuStringW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetRect"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InflateRect"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "EnumThreadWindows"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetParent"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "TranslateAcceleratorW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetMenuDefaultItem"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetCaretPos"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DeleteMenu"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetProcessWindowStation"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetFocus"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "UnregisterHotKey"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetMenu"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "PtInRect"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetAsyncKeyState"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DrawMenuBar"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FrameRect"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "OpenWindowStationW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CharUpperBuffW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "SetActiveWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "TranslateMessage"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DrawFocusRect"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "MoveWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "GetSubMenu"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CountClipboardFormats"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DestroyMenu"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "EnumWindows"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "MessageBoxA"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateEnvironmentBlock"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InternetOpenUrlW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InternetCloseHandle"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InternetConnectW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FtpOpenFileW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InternetSetOptionW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "HttpQueryInfoW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InternetCrackUrlW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InternetQueryOptionW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InternetOpenW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "HttpSendRequestW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InternetReadFile"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "FtpGetFileSize"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "InternetQueryDataAvailable"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "HttpOpenRequestW"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "gethostbyname"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ntohs"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "closesocket"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WSACleanup"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "__WSAFDIsSet"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "htons"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WSAStartup"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "recvfrom"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "inet_ntoa"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "inet_addr"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "gethostname"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ioctlsocket"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ProgIDFromCLSID"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "StringFromGUID2"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CoInitializeSecurity"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CoGetObject"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CoInitialize"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "OleSetMenuDescriptor"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "IIDFromString"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "CoUninitialize"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API (Indicator: "ReportEvent"; Source: "00000000-00003344.00000002.173073.00932000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00003344.00000002.173073.00932000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006608.00000000.165120.07080000.00000004.mdmp, 00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00006608.00000000.165120.07080000.00000004.mdmp, 00000000-00006608.00000001.167043.07080000.00000004.mdmp, 00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00006608.00000001.167043.07080000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00006608.00000001.167043.07080000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00006608.00000001.167043.07080000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006608.00000001.167043.07080000.00000004.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "WNetUseConnectionW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "WNetGetConnectionW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InternetSetOptionW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InternetCrackUrlW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryOptionW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FtpOpenFileW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FtpGetFileSize"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenUrlW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InternetQueryDataAvailable"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessMemoryInfo"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "IcmpSendEcho"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateEnvironmentBlock"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DestroyEnvironmentBlock"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "VirtualFreeEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CopyFileExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetSystemPowerState"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileSectionW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionNamesW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetVolumeLabelW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateHardLinkW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessIoCounters"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetPriorityClass"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "OpenWindowStationW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetProcessWindowStation"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "OpenDesktopW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CloseWindowStation"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CharUpperBuffW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "AttachThreadInput"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CopyRect"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CheckMenuRadioItem"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DeleteMenu"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InsertMenuItemW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetMenuDefaultItem"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CountClipboardFormats"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CopyImage"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RegisterHotKey"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "IsCharUpperW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetMenuStringW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetCaretPos"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "TranslateAcceleratorW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DrawFocusRect"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DrawFrameControl"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DestroyMenu"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetMenu"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RoundRect"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithLogonW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LogonUserW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "Shell_NotifyIconW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SHGetDesktopFolder"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ProgIDFromCLSID"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "OleSetMenuDescriptor"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")28:T89a,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")29:T4db,Observed string: ""%WINDIR%\system32\cmd.exe" /c copy Ind.m4a Ind.m4a.bat & Ind.m4a.bat" (Indicator: "/c copy ") in Source: 00000000-00007484-00000C46-4897795282 Observed string: "/c copy Ind.m4a Ind.m4a.bat & Ind.m4a.bat" (Indicator: "/c copy ") in Source: 00000000-00007484-00000C71-4943399246 Observed string: "cmd /c copy /b ..\Howard.m4a + ..\Cannon.m4a + ..\Cherry.m4a + ..\Limit.m4a + ..\Motor.m4a + ..\Assess.m4a + ..\Tires.m4a + ..\Ab" (Indicator: "/c copy ") in Source: 00000000-00008020-00000C46-54558442662 Observed string: "cmd /c copy /b ..\Howard.m4a + ..\Cannon.m4a + ..\Cherry.m4a + ..\Limit.m4a + ..\Motor.m4a + ..\Assess.m4a + ..\Tires.m4a + ..\Above.m4a + ..\Baking.m4a + ..\Rid.m4a + ..\Blocking.m4a + ..\Landing.m4a + ..\Temple.m4a + ..\Damn.m4a + ..\Mysterious.m4a + ..\Michael.m4a + ..\Curves.m4a + ..\Worldcat.m4a + ..\Karma.m4a + ..\Shuttle.m4a + ..\Pay.m4a + ..\Messages.m4a + ..\Amount.m4a + ..\Five.m4a + ..\Motel.m4a + ..\Latinas.m4a + ..\Messenger.m4a + ..\Lens.m4a + ..\Hydrocodone.m4a + ..\Organisations.m4a + ..\Cole.m4a + ..\Ipaq.m4a + ..\Licenses.m4a + ..\Catch.m4a + ..\Garage.m4a + ..\Knit.m4a + ..\Ages.m4a + ..\Parameter.m4a + ..\Ir.m4a + ..\Puzzle.m4a n" (Indicator: "/c copy ") in Source: cmd.exe2a:T626,Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")2b:Tc93,"cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter SmokeDiplomaInstrumentationPhotographsVolunteer (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter C:\Mirc\mirc.ini (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter ReflectAmateur (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter RepresentsParticularlyFunMemorabilia (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter IncentivesCannon (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter CbOCentralSmoking (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter StaysVerifyDomeBright (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter SitesJungleMurphyDesktop (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter OrganisationJungleConvinced (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter InvitedConfigVessel (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter RollsInstallationsBikesSupposedStudying (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter DrLenderDue (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter TypesRollingSoundtrackAdvert (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter BraFinalFeelingDecadesPractical (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter ParentAttorneyExtensiveHappensDepartmental (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter DimensionalNswSysConceptsExperience (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter PortMadnessBuffer (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter CentresArthritisPrintingAlpine (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter MildHideBellyHill (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter InclusiveBsPittsburghCryNavigationCooperative (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "FindFirstFileW" with parameter EosIdeasIntegratingCubicPatrol (UID: 00000000-00007484) "Solved.com" called "FindFirstFileW" with parameter %LOCALAPPDATA%\DataDive Technologies\DataDash.com (UID: 00000000-00006608) "Solved.com" called "FindFirstFileW" with parameter %LOCALAPPDATA%\DataDive Technologies\S (UID: 00000000-00006608) "Solved.com" called "FindFirstFileW" with parameter %LOCALAPPDATA%\DataDive Technologies\ (UID: 00000000-00006608) "Solved.com" called "FindFirstFileW" with parameter %TEMP%\87966\n (UID: 00000000-00006608)2c:T8fa,"cac213f52f629a3b514dfbe6f6aed65f.exe" file has an entrypoint instructions - "sub esp, 0x2d4,push ebx,push ebp,push esi,push edi,push 0x20,xor ebp, ebp,pop esi,mov dword ptr [esp + 0x18], ebp,mov dword ptr [esp + 0x10], 0x408570,mov dword ptr [esp + 0x14], ebp,call dword ptr [0x408030],push 0x8001,call dword ptr [0x4080b4],push ebp,call dword ptr [0x4082b0],push 8,mov dword ptr [0x470678], eax,call 0x405b93,push ebp,push 0x2b4,mov dword ptr [0x470590], eax,lea eax, [esp + 0x38],push eax,push ebp,push 0x40856c,call dword ptr [0x408180],push 0x408554," "Solved.com" file has an entrypoint instructions - "call 0x420e5a,jmp 0x42076b,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x420957,mov dword ptr [esi], 0x4a0dc0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x4a0dc8,mov dword ptr [ecx], 0x4a0dc0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x420957,mov dword ptr [esi], 0x4a0ddc,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "RegAsm.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2d:Tfb3,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetAce" (Indicator: "GetAce"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "AddAce" (Indicator: "AddAce"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")2e:T840,Spawned process "cac213f52f629a3b514dfbe6f6aed65f.exe" (UID: 00000000-00007484) Spawned process "cmd.exe" with commandline "/c copy Ind.m4a Ind.m4a.bat & Ind.m4a.bat" (UID: 00000000-00008020) Spawned process "tasklist.exe" (UID: 00000000-00000752) Spawned process "findstr.exe" with commandline "findstr /I "opssvc wrsa"" (UID: 00000000-00003088) Spawned process "tasklist.exe" (UID: 00000000-00005364) Spawned process "findstr.exe" with commandline "findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn"" (UID: 00000000-00000724) Spawned process "cmd.exe" with commandline "cmd /c md 87966" (UID: 00000000-00003864) Spawned process "extrac32.exe" with commandline "extrac32 /Y /E Passwords.m4a" (UID: 00000000-00004888) Spawned process "findstr.exe" with commandline "findstr /V "float" Blind" (UID: 00000000-00006740) Spawned process "cmd.exe" with commandline "cmd /c copy /b ..\\Howard.m4a + ..\\Cannon.m4a + ..\\Cherry.m4a + ..\\Limit.m4a + ..\\Motor.m4a + ..\\Assess.m4a + ..\\Tires.m4a + ..\\Above.m4a + ..\\Baking.m4a + ..\\Rid.m4a + ..\\Blocking.m4a + ..\\Landing.m4a + ..\\Temple.m4a + ..\\Damn.m4a + ..\\Mysterious.m4a + ..\\Michael.m4a + ..\\Curves.m4a + ..\\Worldcat.m4a + ..\\Karma.m4a + ..\\Shuttle.m4a + ..\\Pay.m4a + ..\\Messages.m4a + ..\\Amount.m4a + ..\\Five.m4a + ..\\Motel.m4a + ..\\Latinas.m4a + ..\\Messenger.m4a + ..\\Lens.m4a + ..\\Hydrocodone.m4a + ..\\Organisations.m4a + ..\\Cole.m4a + ..\\Ipaq.m4a + ..\\Licenses.m4a + ..\\Catch.m4a + ..\\Garage.m4a + ..\\Knit.m4a + ..\\Ages.m4a + ..\\Parameter.m4a + ..\\Ir.m4a + ..\\Puzzle.m4a n" (UID: 00000000-00000208) Spawned process "Solved.com" with commandline "n" (UID: 00000000-00006608) Spawned process "cmd.exe" with commandline "cmd /k echo [InternetShortcut] > "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\DataDash.url" & echo URL="%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\DataDash.url" & exit" (UID: 00000000-00000268) Spawned process "choice.exe" with commandline "choice /d y /t 5" (UID: 00000000-00004588) Spawned process "RegAsm.exe" (UID: 00000000-00003344)2f:T4d6,Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")30:T476,Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")31:T4e0,"Solved.com" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00003820) "Solved.com" called "Process32NextW with parameter System" (UID: 00000000-00003820) "Solved.com" called "Process32NextW with parameter smss.exe" (UID: 00000000-00003820) "Solved.com" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00003820) "Solved.com" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00003820) "Solved.com" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00003820) "Solved.com" called "Process32NextW with parameter services.exe" (UID: 00000000-00003820) "Solved.com" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00003820) "Solved.com" called "Process32NextW with parameter lsm.exe" (UID: 00000000-00003820) "Solved.com" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00003820) "Solved.com" called "Process32NextW with parameter spoolsv.exe" (UID: 00000000-00003820) "Solved.com" called "Process32NextW with parameter taskhost.exe" (UID: 00000000-00003820) "Solved.com" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00003820) "Solved.com" called "Process32NextW with parameter explorer.exe" (UID: 00000000-00003820)32:T4f4,Spawned process "cmd.exe" with commandline "/c copy Ind.m4a Ind.m4a.bat & Ind.m4a.bat" (UID: 00000000-00008020) Spawned process "tasklist.exe" (UID: 00000000-00000752) Spawned process "findstr.exe" with commandline "findstr /I "opssvc wrsa"" (UID: 00000000-00003088) Spawned process "tasklist.exe" (UID: 00000000-00005364) Spawned process "findstr.exe" with commandline "findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn ..." (UID: 00000000-00000724), Spawned process "cmd.exe" with commandline "cmd /c md 87966" (UID: 00000000-00003864), Spawned process "extrac32.exe" with commandline "extrac32 /Y /E Passwords.m4a" (UID: 00000000-00004888), Spawned process "findstr.exe" with commandline "findstr /V "float" Blind" (UID: 00000000-00006740), Spawned process "cmd.exe" with commandline "cmd /c copy /b ..\\Howard.m4a + ..\\Cannon.m4a + ..\\Cherry.m4a ..." (UID: 00000000-00000208), Spawned process "Solved.com" with commandline "n" (UID: 00000000-00006608), Spawned process "cmd.exe" with commandline "cmd /k echo [InternetShortcut] > "%APPDATA%\\Microsoft\\Windows\ ..." (UID: 00000000-00000268) Spawned process "choice.exe" with commandline "choice /d y /t 5" (UID: 00000000-00004588) Spawned process "RegAsm.exe" (UID: 00000000-00003344)33:Tb9c,Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")34:T4e3,Found reference to API "ShowWindow" (Indicator: "ShowWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "word FillAttribute; dword Flags; word ShowWindow; word Reserved2; ptr Reserved2; ptr hStdInput; ptr hStdOutput; ptr hS" (Indicator: "ShowWindow"; Source: "00000000-00006608.00000000.165120.07080000.00000004.mdmp, 00000000-00006608.00000001.167043.07080000.00000004.mdmp, 00000000-00006608.00000002.168963.07080000.00000004.mdmp") Found reference to API "word FillAttribute; dword Flags; word ShowWindow; word Reserved2; ptr Reserved2; ptr hStdInput; ptr hStdOutput; ptr hStdError" (Indicator: "ShowWindow"; Source: "00000000-00006608.00000000.165120.07080000.00000004.mdmp, 00000000-00006608.00000001.167043.07080000.00000004.mdmp, 00000000-00006608.00000002.168963.07080000.00000004.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")35:T6fa,Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")36:Tb61,Found string "SHGetFolderPathW" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: SHFOLDER.DLL) Found string "SHAutoComplete" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: SHLWAPI.DLL) Found string "GetUserDefaultUILanguage" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNELBASE.DLL) Found string "AdjustTokenPrivileges" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: ADVAPI32.DLL) Found string "LookupPrivilegeValueW" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: ADVAPI32.DLL) Found string "OpenProcessToken" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: ADVAPI32.DLL) Found string "RegDeleteKeyExW" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: ADVAPI32.DLL) Found string "MoveFileExW" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNEL32.DLL) Found string "GetDiskFreeSpaceExW" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNELBASE.DLL) Found string "Module32NextW" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNEL32.DLL) Found string "Module32FirstW" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNEL32.DLL) Found string "Process32NextW" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNEL32.DLL) Found string "Process32FirstW" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNEL32.DLL) Found string "CreateToolhelp32Snapshot" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNEL32.DLL) Found string "MulDiv" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNEL32.DLL) Found string "DeleteFileW" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNELBASE.DLL) Found string "FindFirstFileW" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNELBASE.DLL) Found string "FindNextFileW" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNELBASE.DLL) Found string "FindClose" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNELBASE.DLL) Found string "SetFilePointer" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNELBASE.DLL) Found string "MultiByteToWideChar" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNELBASE.DLL) Found string "ReadFile" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNELBASE.DLL) Found string "WriteFile" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNELBASE.DLL) Found string "lstrlenA" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNELBASE.DLL) Found string "WideCharToMultiByte" (Source: cac213f52f629a3b514dfbe6f6aed65f.exe, API is part of module: KERNELBASE.DLL)37:T2bcf,"cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76230000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76230000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76230000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "KERNEL32" at base 74490000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d50000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 735d0000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "SHFOLDER" at base 72d30000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "KERNEL32.DLL" at base 74490000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73070000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "RICHED20" at base 72c40000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "COMCTL32.DLL" at base 716c0000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76950000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "COMCTL32.DLL" at base 729c0000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "SHELL32.DLL" at base 74560000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "RPCRT4.DLL" at base 76c00000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 728f0000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74560000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74490000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "USER32.DLL" at base 75a40000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73410000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "MSISO.DLL" at base 72890000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "SSPICLI.DLL" at base 73b20000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76230000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "NTDLL.DLL" at base 77100000 "cac213f52f629a3b514dfbe6f6aed65f.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75c10000 "cmd.exe" loaded module "KERNEL32" at base 74490000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76230000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76230000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76230000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74100000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76230000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76230000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76230000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d50000 "cmd.exe" loaded module "KERNEL32.DLL" at base 74490000 "cmd.exe" loaded module "NTDLL.DLL" at base 77100000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73a70000 "tasklist.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76230000 "tasklist.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76230000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76230000 "tasklist.exe" loaded module "KERNEL32" at base 74490000 "tasklist.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d50000 "tasklist.exe" loaded module "RPCRT4.DLL" at base 76c00000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76230000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72d30000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WINSTA.DLL" at base 72f20000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72a50000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72990000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76230000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76230000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 72970000 "tasklist.exe" loaded module "NTDLL.DLL" at base 77100000 "Solved.com" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76230000 "Solved.com" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76230000 "Solved.com" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76230000 "Solved.com" loaded module "KERNEL32" at base 74490000 "Solved.com" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d50000 "Solved.com" loaded module "KERNEL32.DLL" at base 74490000 "Solved.com" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 735d0000 "Solved.com" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 76230000 "Solved.com" loaded module "COMCTL32.DLL" at base 72a70000 "Solved.com" loaded module "COMCTL32" at base 72a70000 "Solved.com" loaded module "PSAPI.DLL" at base 76fe0000 "Solved.com" loaded module "MSVCRT.DLL" at base 74130000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76230000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76230000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76230000 "RegAsm.exe" loaded module "KERNEL32" at base 74490000 "RegAsm.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d50000 "RegAsm.exe" loaded module "ADVAPI32.DLL" at base 77010000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72c30000 "RegAsm.exe" loaded module "SHLWAPI.DLL" at base 75bc0000 "RegAsm.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75a30000 "RegAsm.exe" loaded module "VERSION.DLL" at base 73840000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71980000 "RegAsm.exe" loaded module "USER32.DLL" at base 75a40000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76230000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "RegAsm.exe" loaded module "MSCOREE.DLL" at base 72450000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76470000 "RegAsm.exe" loaded module "PSAPI.DLL" at base 76fe0000 "RegAsm.exe" loaded module "RPCRT4.DLL" at base 76c00000 "RegAsm.exe" loaded module "KERNEL32.DLL" at base 74490000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70000000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "RegAsm.exe" loaded module "OLE32.DLL" at base 76e30000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 735d0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "RegAsm.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76470000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76230000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72ad0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f5a0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "RegAsm.exe" loaded module "SSPICLI.DLL" at base 73b20000 "RegAsm.exe" loaded module "NTDLL.DLL" at base 77100000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "RegAsm.exe" loaded module "SHELL32.DLL" at base 74560000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6ed80000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76230000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 72ab0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72d30000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 72a10000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72a00000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72940000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76230000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76230000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "RegAsm.exe" loaded module "OLEAUT32.DLL" at base 73fd0000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76230000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76230000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76230000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "RegAsm.exe" loaded module "BCRYPT.DLL" at base 72ea0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72680000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76f80000 "RegAsm.exe" loaded module "ADVAPI32" at base 77010000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 72830000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6e600000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "RegAsm.exe" loaded module "CRYPT32.DLL" at base 741f0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32" at base 0 "RegAsm.exe" loaded module "CRYPT32" at base 741f0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "RegAsm.exe" loaded module "WS2_32.DLL" at base 759c0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72dd0000 "RegAsm.exe" loaded module "IMM32.DLL" at base 74100000 "RegAsm.exe" loaded module "COMCTL32.DLL" at base 72700000 "RegAsm.exe" loaded module "GDI32.DLL" at base 770d000038:T40c,"cac213f52f629a3b514dfbe6f6aed65f.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to touch file "C:\Windows\SysWOW64\version.dll" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to touch file "C:\Windows\SysWOW64\oleaut32.dll" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to touch file "C:\Windows\SysWOW64\cryptsp.dll"39:T1bda,"cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000400b3d000000000050ef39005916147701000000080000000100000000008f0200000000100000000000000000000000020000000200000000008f0201000000080000000000000070ef3900ee13147701000000ee131477080000000000000008000000bb648381a8f13900ad9cca7200008f020800000001000000 (UID: 00000000-00007484) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000080000580f00000d007000a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff61006c0000000000b1080000001000000000000018f134030f00010e06fd000e63006f006e00660069006700750072006100740069006f006e000000670000000f00000f1bfd000080123403a0f1340366007400 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000028125e050000320304d2d6721800000000000000000000000300000002000000000032030c000000000000002000000034f1f707ee13147728125e05ee13147700000000000000000c00000040983a0300983a034cf1f7072823bc7200003203000000000c00000060c25f0558f1f7072f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000003203000000001800000000000000000000000300000002000000000032030c000000000000004e90de1a2cc1cf00ee13147700000000ee13147700000000000000000c000000ffff96723c36390344c1cf002823bc7200003203000000000c000000b014947250c1cf002f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000003203000000001800000000000000000000000300000002000000000032030c0000000000000008c2cf00e4c1cf00ee13147700000000ee13147700000000000000000c000000f8c3cf00fffffffffcc1cf002823bc7200003203000000000c00000030a5a17208c2cf002f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000028125e050000320304d2d6721800000000000000000000000300000002000000000032030c0000000000000020000000a4ef7d08ee13147728125e05ee13147700000000000000000c00000090993c0300993c03bcef7d082823bc7200003203000000000c00000020226005c8ef7d082f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001614770c000000000000000000000000003203100000001800000000000000000000000300000002000000000032030c0000000000000034c1cf0020c1cf00ee13147700000000ee13147700000000000000000c000000ffff967238c1cf002823bc7200003203000000000c000000b014947244c1cf002f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000003203000000001800000000000000000000000300000002000000000032030c0000000000000008c2cf00e4c1cf00ee13147700000000ee13147700000000000000000c000000f8c3cf0002000000fcc1cf002823bc7200003203000000000c00000030a5a17208c2cf002f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001614770c000000000000000000000000003203100000001800000000000000000000000300000002000000000032030c000000000000003cdceb0828dceb08ee13147700000000ee13147700000000000000000c000000ffff967240dceb082823bc7200003203000000000c000000b01494724cdceb082f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001614770c00000000000000000000000000320378c03e031800000000000000000000000300000002000000000032030c00000000000000d724d572e0dceb08ee13147700000000ee13147700000000000000000c000000f0deeb08f8dceb082823bc7200003203000000000c00000030a5a17204ddeb082f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000028125e050000320304d2d6721800000000000000000000000300000002000000000032030c000000000000002000000024ef5309ee13147728125e05ee13147700000000000000000c00000038bf3e0300bf3e033cef53092823bc7200003203000000000c000000f81a6b0548ef53092f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000320300eb3f031800000000000000000000000300000002000000000032030c00000000000000be8afa121cdceb08ee13147700000000ee13147700000000000000000c000000ffff967224be3e0334dceb082823bc7200003203000000000c000000b014947240dceb082f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001614770c000000000000000000000000003203c0be3e031800000000000000000000000300000002000000000032030c00000000000000d724d572e0dceb08ee13147700000000ee13147700000000000000000c000000f0deeb08f8dceb082823bc7200003203000000000c00000030a5a17204ddeb082f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000028125e050000320304d2d6721800000000000000000000000300000002000000000032030c000000000000002000000044f15309ee13147728125e05ee13147700000000000000000c00000058bd3e0300bd3e035cf153092823bc7200003203000000000c000000f85a6b0568f153092f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001614770c000000000000000000000000003203100000001800000000000000000000000300000002000000000032030c000000000000004cc4eb0838c4eb08ee13147700000000ee13147700000000000000000c000000ffff967250c4eb082823bc7200003203000000000c000000b01494725cc4eb082f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001614770c00000000000000000000000000320388bf3e031800000000000000000000000300000002000000000032030c00000000000000d724d572f0c4eb08ee13147700000000ee13147700000000000000000c00000000c7eb0808c5eb082823bc7200003203000000000c00000030a5a17214c5eb082f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000028125e050000320304d2d6721800000000000000000000000300000002000000000032030c000000000000002000000084ec5309ee13147728125e05ee13147700000000000000000c000000709a3a03009a3a039cec53092823bc7200003203000000000c000000f8da6e05a8ec53092f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000320308eb3f031800000000000000000000000300000002000000000032030c000000000000004e95fa122cc4eb08ee13147700000000ee13147700000000000000000c000000ffff967284bd3e0344c4eb082823bc7200003203000000000c000000b014947250c4eb082f99a1720c000000 (UID: 00000000-00003344) "RegAsm.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001614770c000000000000000000000000003203c0963c031800000000000000000000000300000002000000000032030c00000000000000d724d572f0c4eb08ee13147700000000ee13147700000000000000000c00000000c7eb0808c5eb082823bc7200003203000000000c00000030a5a17214c5eb082f99a1720c000000 (UID: 00000000-00003344)3a:T8b4,Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: Solved.com] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Solved.com] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: Solved.com] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: Solved.com] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: Solved.com] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: Solved.com] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Solved.com] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: Solved.com] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: Solved.com] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: Solved.com] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: Solved.com] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Solved.com] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: Solved.com] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: Solved.com] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Solved.com] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: Solved.com]3b:T7d1,"cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\edputil.dll" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\URLMON.DLL" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\urlmon.dll" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\iertutil.dll" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\CLDAPI.DLL" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\CLDAPI.dll" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\AEPIC.DLL" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\AEPIC.dll" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\BCRYPT.DLL" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\bcrypt.dll" "cmd.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "tasklist.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "tasklist.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "tasklist.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "tasklist.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\WBEMCOMN.DLL" "tasklist.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "tasklist.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\BCRYPT.DLL" "tasklist.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\bcrypt.dll"3c:T12f2,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found URL "http://ocsp2.globalsign.com/rootr306/0-0+%http://crl.globalsign.com/root-r3.crl0c\0z0_0402&https://www.globalsign.com/repository/0jee-mih?" - Source: "00000000-00006608.00000000.165120.07080000.00000004.mdmp") Found URL "http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08,http://ocsp2.globalsign.com/gscodesignsha2g30vo0m0a20402&https://www.globalsign.com/repository/080604.http://crl.globalsign.com/gscodesignsha2g3.crl02lnfi4v(f&zp20j0z1globalsign" - Source: "00000000-00006608.00000000.165120.07080000.00000004.mdmp") Found URL "https://www.autoitscript.com/autoit3/" - Source: "00000000-00006608.00000000.165120.07080000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/0" - Source: "00000000-00006608.00000000.165120.07080000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/ca/gstsacasha384g40c7http://secure.globalsign.com/cacert/gstsacasha384g4.crt0we93:08060http://crl.globalsign.com/ca/gstsacasha384g4.crl0w/bok" - Source: "00000000-00006608.00000000.165120.07080000.00000004.mdmp") Found URL "http://ocsp2.globalsign.com/rootr606/0-0+%http://crl.globalsign.com/root-r6.crl0g@0>0<0402&https://www.globalsign.com/repository/0wg+b_4heuhdi/$ktz" - Source: "00000000-00006608.00000000.165120.07080000.00000004.mdmp") Found URL "http://ocsp2.globalsign.com/rootr306/0-0+%http://crl.globalsign.com/root-r3.crl0g@0>0<0402&https://www.globalsign.com/repository/0" - Source: "00000000-00006608.00000000.165120.07080000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3/filedescriptionautoit" - Source: "00000000-00006608.00000001.167043.00A45000.00000002.mdmp") Found URL "http://ocsp2.globalsign.com/rootr306/0-0+%http://crl.globalsign.com/root-r3.crl0c\0z0_0402&https://www.globalsign.com/repository/0jee-mih?" - Source: "00000000-00006608.00000001.167043.07080000.00000004.mdmp") Found URL "http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08,http://ocsp2.globalsign.com/gscodesignsha2g30vo0m0a20402&https://www.globalsign.com/repository/080604.http://crl.globalsign.com/gscodesignsha2g3.crl02lnfi4v(f&zp20j0z1globalsign" - Source: "00000000-00006608.00000001.167043.07080000.00000004.mdmp") Found URL "https://www.autoitscript.com/autoit3/" - Source: "00000000-00006608.00000001.167043.07080000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/0" - Source: "00000000-00006608.00000001.167043.07080000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/ca/gstsacasha384g40c7http://secure.globalsign.com/cacert/gstsacasha384g4.crt0we93:08060http://crl.globalsign.com/ca/gstsacasha384g4.crl0w/bok" - Source: "00000000-00006608.00000001.167043.07080000.00000004.mdmp") Found URL "http://ocsp2.globalsign.com/rootr606/0-0+%http://crl.globalsign.com/root-r6.crl0g@0>0<0402&https://www.globalsign.com/repository/0wg+b_4heuhdi/$ktz" - Source: "00000000-00006608.00000001.167043.07080000.00000004.mdmp") Found URL "http://ocsp2.globalsign.com/rootr306/0-0+%http://crl.globalsign.com/root-r3.crl0g@0>0<0402&https://www.globalsign.com/repository/0" - Source: "00000000-00006608.00000001.167043.07080000.00000004.mdmp") Found URL "http://ocsp2.globalsign.com/rootr306/0-0+%http://crl.globalsign.com/root-r3.crl0c\0z0_0402&https://www.globalsign.com/repository/0jee-mih?" - Source: "00000000-00006608.00000002.168963.07080000.00000004.mdmp") Found URL "http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08,http://ocsp2.globalsign.com/gscodesignsha2g30vo0m0a20402&https://www.globalsign.com/repository/080604.http://crl.globalsign.com/gscodesignsha2g3.crl02lnfi4v(f&zp20j0z1globalsign" - Source: "00000000-00006608.00000002.168963.07080000.00000004.mdmp") Found URL "https://www.autoitscript.com/autoit3/" - Source: "00000000-00006608.00000002.168963.07080000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/0" - Source: "00000000-00006608.00000002.168963.07080000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/ca/gstsacasha384g40c7http://secure.globalsign.com/cacert/gstsacasha384g4.crt0we93:08060http://crl.globalsign.com/ca/gstsacasha384g4.crl0w/bok" - Source: "00000000-00006608.00000002.168963.07080000.00000004.mdmp") Found URL "http://ocsp2.globalsign.com/rootr606/0-0+%http://crl.globalsign.com/root-r6.crl0g@0>0<0402&https://www.globalsign.com/repository/0wg+b_4heuhdi/$ktz" - Source: "00000000-00006608.00000002.168963.07080000.00000004.mdmp") Found URL "http://ocsp2.globalsign.com/rootr306/0-0+%http://crl.globalsign.com/root-r3.crl0g@0>0<0402&https://www.globalsign.com/repository/0" - Source: "00000000-00006608.00000002.168963.07080000.00000004.mdmp")3d:T4e6,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")3e:Tbb68,"cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007484) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008020) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008020) "tasklist.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00000752) "tasklist.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00005364) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00005364) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003864) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000208) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000208) "Solved.com" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter NtReadVirtualMemory (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter RtlGetCompressionWorkSpaceSize (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter RtlDecompressFragment (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter VirtualAllocExNuma (UID: 00000000-00006608) "Solved.com" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00006608) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000268) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000268) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003344) "RegAsm.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003344)3f:T168e,"Solved.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\87966\Solved.com]- [targetUID: 00000000-00006608] "RegAsm.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%TEMP%\87966\RegAsm.exe]- [targetUID: 00000000-00006608] "S" has type "data"- Location: [%LOCALAPPDATA%\DataDive Technologies\S]- [targetUID: 00000000-00006608] "Passwords.m4a" has type "Microsoft Cabinet archive data many 489049 bytes 11 files at 0x2c last modified Sun May 28 2025 06:18:52 +A "Pam" last modified Sun May 28 2025 06:18:52 +A "Liked" ID 5630 number 1 29 datablocks 0x1 compression"- Location: [%TEMP%\Passwords.m4a]- [targetUID: 00000000-00007484] "Baking.m4a" has type "data"- Location: [%TEMP%\Baking.m4a]- [targetUID: 00000000-00007484] "Assess.m4a" has type "data"- Location: [%TEMP%\Assess.m4a]- [targetUID: 00000000-00007484] "Rid.m4a" has type "data"- Location: [%TEMP%\Rid.m4a]- [targetUID: 00000000-00007484] "Catch.m4a" has type "data"- Location: [%TEMP%\Catch.m4a]- [targetUID: 00000000-00007484] "Tires.m4a" has type "data"- Location: [%TEMP%\Tires.m4a]- [targetUID: 00000000-00007484] "Licenses.m4a" has type "data"- Location: [%TEMP%\Licenses.m4a]- [targetUID: 00000000-00007484] "Organisations.m4a" has type "data"- Location: [%TEMP%\Organisations.m4a]- [targetUID: 00000000-00007484] "Messages.m4a" has type "OpenPGP Secret Key"- Location: [%TEMP%\Messages.m4a]- [targetUID: 00000000-00007484] "Lens.m4a" has type "data"- Location: [%TEMP%\Lens.m4a]- [targetUID: 00000000-00007484] "Mysterious.m4a" has type "data"- Location: [%TEMP%\Mysterious.m4a]- [targetUID: 00000000-00007484] "Motor.m4a" has type "data"- Location: [%TEMP%\Motor.m4a]- [targetUID: 00000000-00007484] "Motel.m4a" has type "data"- Location: [%TEMP%\Motel.m4a]- [targetUID: 00000000-00007484] "Worldcat.m4a" has type "data"- Location: [%TEMP%\Worldcat.m4a]- [targetUID: 00000000-00007484] "Cannon.m4a" has type "data"- Location: [%TEMP%\Cannon.m4a]- [targetUID: 00000000-00007484] "Latinas.m4a" has type "data"- Location: [%TEMP%\Latinas.m4a]- [targetUID: 00000000-00007484] "Cole.m4a" has type "data"- Location: [%TEMP%\Cole.m4a]- [targetUID: 00000000-00007484] "Above.m4a" has type "data"- Location: [%TEMP%\Above.m4a]- [targetUID: 00000000-00007484] "Parameter.m4a" has type "data"- Location: [%TEMP%\Parameter.m4a]- [targetUID: 00000000-00007484] "Blocking.m4a" has type "data"- Location: [%TEMP%\Blocking.m4a]- [targetUID: 00000000-00007484] "Five.m4a" has type "OpenPGP Secret Key"- Location: [%TEMP%\Five.m4a]- [targetUID: 00000000-00007484] "Michael.m4a" has type "data"- Location: [%TEMP%\Michael.m4a]- [targetUID: 00000000-00007484] "Ir.m4a" has type "data"- Location: [%TEMP%\Ir.m4a]- [targetUID: 00000000-00007484] "Curves.m4a" has type "data"- Location: [%TEMP%\Curves.m4a]- [targetUID: 00000000-00007484] "Karma.m4a" has type "data"- Location: [%TEMP%\Karma.m4a]- [targetUID: 00000000-00007484] "Landing.m4a" has type "OpenPGP Secret Key"- Location: [%TEMP%\Landing.m4a]- [targetUID: 00000000-00007484] "Cherry.m4a" has type "data"- Location: [%TEMP%\Cherry.m4a]- [targetUID: 00000000-00007484] "Ages.m4a" has type "data"- Location: [%TEMP%\Ages.m4a]- [targetUID: 00000000-00007484] "Shuttle.m4a" has type "data"- Location: [%TEMP%\Shuttle.m4a]- [targetUID: 00000000-00007484] "Damn.m4a" has type "data"- Location: [%TEMP%\Damn.m4a]- [targetUID: 00000000-00007484] "Howard.m4a" has type "data"- Location: [%TEMP%\Howard.m4a]- [targetUID: 00000000-00007484] "Ipaq.m4a" has type "data"- Location: [%TEMP%\Ipaq.m4a]- [targetUID: 00000000-00007484] "Temple.m4a" has type "data"- Location: [%TEMP%\Temple.m4a]- [targetUID: 00000000-00007484] "Hydrocodone.m4a" has type "OpenPGP Secret Key"- Location: [%TEMP%\Hydrocodone.m4a]- [targetUID: 00000000-00007484] "Knit.m4a" has type "data"- Location: [%TEMP%\Knit.m4a]- [targetUID: 00000000-00007484] "Garage.m4a" has type "OpenPGP Secret Key"- Location: [%TEMP%\Garage.m4a]- [targetUID: 00000000-00007484] "Pay.m4a" has type "data"- Location: [%TEMP%\Pay.m4a]- [targetUID: 00000000-00007484] "Amount.m4a" has type "data"- Location: [%TEMP%\Amount.m4a]- [targetUID: 00000000-00007484] "Limit.m4a" has type "data"- Location: [%TEMP%\Limit.m4a]- [targetUID: 00000000-00007484] "Messenger.m4a" has type "data"- Location: [%TEMP%\Messenger.m4a]- [targetUID: 00000000-00007484] "Puzzle.m4a" has type "data"- Location: [%TEMP%\Puzzle.m4a]- [targetUID: 00000000-00007484] "Ind.m4a" has type "ASCII text with very long lines (4973) with CRLF line terminators"- Location: [%TEMP%\Ind.m4a]- [targetUID: 00000000-00007484] "Finder-Latest.log" has type "ASCII text"- Location: [%APPDATA%\Finder-Latest.log]- [targetUID: 00000000-00003344] "DataDash.js" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\DataDive Technologies\DataDash.js]- [targetUID: 00000000-00006608] "clipboard_logs.txt" has type "ASCII text"- Location: [%LOCALAPPDATA%\b8755439bbaef8499326d21b38ff3487\logs\clipboard\2025-06-01\clipboard_logs.txt]- [targetUID: 00000000-00003344] "DataDash.url" has type "MS Windows 95 Internet shortcut text ASCII text with CRLF line terminators"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\DataDash.url]- [targetUID: 00000000-00000268] "DataDash.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%LOCALAPPDATA%\DataDive Technologies\DataDash.com]- [targetUID: 00000000-00006608] "Ind.m4a.bat" has type "ASCII text with very long lines (4973) with CRLF line terminators"- Location: [%TEMP%\Ind.m4a.bat]- [targetUID: 00000000-00008020] "n" has type "data"- Location: [%TEMP%\87966\n]- [targetUID: 00000000-00006608]40:T454,Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp")41:T550,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")42:T8ad,"RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:ffffffffc0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\crypt32" - [base:0; Status:ffffffffc0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:ffffffffc0000135]43:T9fd,"cac213f52f629a3b514dfbe6f6aed65f.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") "cac213f52f629a3b514dfbe6f6aed65f.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "cac213f52f629a3b514dfbe6f6aed65f.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "cac213f52f629a3b514dfbe6f6aed65f.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "cac213f52f629a3b514dfbe6f6aed65f.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "cac213f52f629a3b514dfbe6f6aed65f.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "cac213f52f629a3b514dfbe6f6aed65f.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "cac213f52f629a3b514dfbe6f6aed65f.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "cac213f52f629a3b514dfbe6f6aed65f.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "tasklist.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "tasklist.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "tasklist.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\WOW6432NODE\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS") "RegAsm.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32")44:Ta01,"cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\TASKLIST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\FINDSTR.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\EXTRAC32.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\87966\SOLVED.COM"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CHOICE.EXE"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "Solved.com" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "Solved.com" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "Solved.com" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "")45:T4ce7,Found XOR loop in file "Solved.com" at offset 147235; code bytes = 30d0 Found XOR loop in file "Solved.com" at offset 147247; code bytes = 30d0 Found XOR loop in file "Solved.com" at offset 396834; code bytes = 30d0 Found XOR loop in file "Solved.com" at offset 398473; code bytes = 30d0 Found XOR loop in file "Solved.com" at offset 693770; code bytes = 30d0 Found XOR loop in file "Solved.com" at offset 912249; code bytes = 30d0 Found XOR loop in file "Solved.com" at offset 916557; code bytes = 30d0 Found XOR loop in file "Solved.com" at offset 934331; code bytes = 30d0 Found XOR loop in file "Solved.com" at offset 131670; code bytes = 33c1 Found XOR loop in file "Solved.com" at offset 140923; code bytes = 33c1 Found XOR loop in file "Solved.com" at offset 141052; code bytes = 33c1 Found XOR loop in file "Solved.com" at offset 273667; code bytes = 33c1 Found XOR loop in file "Solved.com" at offset 466268; code bytes = 33c1 Found XOR loop in file "Solved.com" at offset 466343; code bytes = 33c1 Found XOR loop in file "Solved.com" at offset 599738; code bytes = 33c1 Found XOR loop in file "Solved.com" at offset 704490; code bytes = 33c1 Found XOR loop in file "Solved.com" at offset 711829; code bytes = 33c1 Found XOR loop in file "Solved.com" at offset 712277; code bytes = 33c1 Found XOR loop in file "Solved.com" at offset 712853; code bytes = 33c1 Found XOR loop in file "Solved.com" at offset 713301; code bytes = 33c1 Found XOR loop in file "Solved.com" at offset 915677; code bytes = 33c1 Found XOR loop in file "Solved.com" at offset 924943; code bytes = 33c1 Found XOR loop in file "Solved.com" at offset 7122; code bytes = 8030 Found XOR loop in file "Solved.com" at offset 7751; code bytes = 8030 Found XOR loop in file "Solved.com" at offset 67116; code bytes = 8030 Found XOR loop in file "Solved.com" at offset 363915; code bytes = 8030 Found XOR loop in file "Solved.com" at offset 677284; code bytes = 8030 Found XOR loop in file "Solved.com" at offset 689642; code bytes = 8030 Found XOR loop in file "Solved.com" at offset 914380; code bytes = 8030 Found XOR loop in file "Solved.com" at offset 916538; code bytes = 8030 Found XOR loop in file "Solved.com" at offset 921332; code bytes = 8030 Found XOR loop in file "Solved.com" at offset 927186; code bytes = 8030 Found XOR loop in file "Solved.com" at offset 929552; code bytes = 8030 Found XOR loop in file "Solved.com" at offset 934292; code bytes = 8030 Found XOR loop in file "Solved.com" at offset 939380; code bytes = 8030 Found XOR loop in file "Solved.com" at offset 941664; code bytes = 8030 Found XOR loop in file "Solved.com" at offset 941827; code bytes = 8030 Found XOR loop in file "RegAsm.exe" at offset 61346; code bytes = 30d0 Found XOR loop in file "RegAsm.exe" at offset 13430; code bytes = 30040e Found XOR loop in file "RegAsm.exe" at offset 13460; code bytes = 30040e Found XOR loop in file "RegAsm.exe" at offset 10181; code bytes = 8030 Found XOR loop in file "RegAsm.exe" at offset 25425; code bytes = 8030 Found XOR loop in file "RegAsm.exe" at offset 26100; code bytes = 8030 Found XOR loop in file "RegAsm.exe" at offset 28453; code bytes = 8030 Found XOR loop in file "RegAsm.exe" at offset 44718; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 147235; code bytes = 30d0 Found XOR loop in file "DataDash.com" at offset 147247; code bytes = 30d0 Found XOR loop in file "DataDash.com" at offset 396834; code bytes = 30d0 Found XOR loop in file "DataDash.com" at offset 398473; code bytes = 30d0 Found XOR loop in file "DataDash.com" at offset 693770; code bytes = 30d0 Found XOR loop in file "DataDash.com" at offset 912249; code bytes = 30d0 Found XOR loop in file "DataDash.com" at offset 916557; code bytes = 30d0 Found XOR loop in file "DataDash.com" at offset 934331; code bytes = 30d0 Found XOR loop in file "DataDash.com" at offset 131670; code bytes = 33c1 Found XOR loop in file "DataDash.com" at offset 140923; code bytes = 33c1 Found XOR loop in file "DataDash.com" at offset 141052; code bytes = 33c1 Found XOR loop in file "DataDash.com" at offset 273667; code bytes = 33c1 Found XOR loop in file "DataDash.com" at offset 466268; code bytes = 33c1 Found XOR loop in file "DataDash.com" at offset 466343; code bytes = 33c1 Found XOR loop in file "DataDash.com" at offset 599738; code bytes = 33c1 Found XOR loop in file "DataDash.com" at offset 704490; code bytes = 33c1 Found XOR loop in file "DataDash.com" at offset 711829; code bytes = 33c1 Found XOR loop in file "DataDash.com" at offset 712277; code bytes = 33c1 Found XOR loop in file "DataDash.com" at offset 712853; code bytes = 33c1 Found XOR loop in file "DataDash.com" at offset 713301; code bytes = 33c1 Found XOR loop in file "DataDash.com" at offset 915677; code bytes = 33c1 Found XOR loop in file "DataDash.com" at offset 924943; code bytes = 33c1 Found XOR loop in file "DataDash.com" at offset 7122; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 7751; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 67116; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 363915; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 677284; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 689642; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 914380; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 916538; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 921332; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 927186; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 929552; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 934292; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 939380; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 941664; code bytes = 8030 Found XOR loop in file "DataDash.com" at offset 941827; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 41454; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 43411; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 189926; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 199872; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 275111; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 301630; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 344127; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 378854; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 410762; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 456228; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 486471; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 532509; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 541145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 581614; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 589608; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 661116; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 991053; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1049914; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1158185; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1225311; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1340576; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1343062; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1367693; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1369630; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1590157; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1694897; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1790442; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1879549; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1885336; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1946028; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1974576; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2033626; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2130497; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2192286; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2340547; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2418967; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2550569; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2606782; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2648483; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2687668; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2690888; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2699951; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2773534; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2966976; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2999834; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3000794; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3079958; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3089861; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3111640; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3179145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3187776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3252467; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3263412; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3293024; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3388060; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3453222; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3528014; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3551875; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 94191; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 229445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 232459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 281578; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 349390; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 391549; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 397369; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 507163; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 594042; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 661604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 662300; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 763478; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 837399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 841143; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1074944; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1080374; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1091554; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1107384; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1179683; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1187679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1205334; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1222663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1274502; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1324298; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1341874; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1412440; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1456569; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1462067; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1465802; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489387; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1721259; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1774680; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1780655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1829519; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1951994; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1981989; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2028792; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2157740; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2280704; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2282125; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2316175; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2322812; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2407491; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2430552; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2446164; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2562858; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2573725; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2589153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2602476; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2610652; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2754935; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2767809; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2820042; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2826933; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3089453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3099282; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3201058; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3221565; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3272031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3384226; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3407855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3478633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3518789; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3534358; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3545550; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3551893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 77306; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 129383; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 172330; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 175286; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 246554; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 493612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 645302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 647943; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 775059; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 919760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 932138; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 979158; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1076785; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1090072; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1127297; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1186377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1258756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1372184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1376607; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1416387; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1480019; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1671929; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1779070; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1791507; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1830908; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1867663; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1897803; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2172136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2211071; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2297527; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2347601; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2416554; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2549946; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2625380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2636934; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2723497; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2729512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2739056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2805000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2824390; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2878005; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2964240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2970888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3152965; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3168307; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3191713; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3243656; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3270932; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3325660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3376794; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3460237; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3493980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3559909; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3565493; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3607561; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3610302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3610478; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3619449; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3622190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3622366; code bytes = 803046:T4da,"extrac32.exe" called "SetFileTime" on file C:\Users\%OSUSER%\AppData\Local\Temp\Pam (UID: 00000000-00004948) "extrac32.exe" called "SetFileTime" on file C:\Users\%OSUSER%\AppData\Local\Temp\Liked (UID: 00000000-00004948) "extrac32.exe" called "SetFileTime" on file C:\Users\%OSUSER%\AppData\Local\Temp\Kb (UID: 00000000-00004948) "extrac32.exe" called "SetFileTime" on file C:\Users\%OSUSER%\AppData\Local\Temp\Boulder (UID: 00000000-00004948) "extrac32.exe" called "SetFileTime" on file C:\Users\%OSUSER%\AppData\Local\Temp\Social (UID: 00000000-00004948) "extrac32.exe" called "SetFileTime" on file C:\Users\%OSUSER%\AppData\Local\Temp\Blind (UID: 00000000-00004948) "extrac32.exe" called "SetFileTime" on file C:\Users\%OSUSER%\AppData\Local\Temp\La (UID: 00000000-00004948) "extrac32.exe" called "SetFileTime" on file C:\Users\%OSUSER%\AppData\Local\Temp\Reduction (UID: 00000000-00004948) "extrac32.exe" called "SetFileTime" on file C:\Users\%OSUSER%\AppData\Local\Temp\Sku (UID: 00000000-00004948) "extrac32.exe" called "SetFileTime" on file C:\Users\%OSUSER%\AppData\Local\Temp\Chef (UID: 00000000-00004948) "extrac32.exe" called "SetFileTime" on file C:\Users\%OSUSER%\AppData\Local\Temp\Continuity (UID: 00000000-00004948)47:T5c4,"cac213f52f629a3b514dfbe6f6aed65f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tasklist.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Solved.com" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Solved.com" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "RegAsm.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")48:T5f0,"cac213f52f629a3b514dfbe6f6aed65f.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\cmd.exe" /c copy Ind.m4a Ind.m4a.bat & Ind.m4a.bat" - (UID: 00000000-00007484) "cmd.exe" called "CreateProcessW" with parameter "tasklist" - (UID: 00000000-00008020) "cmd.exe" called "CreateProcessW" with parameter "findstr /I "opssvc wrsa"" - (UID: 00000000-00008020) "cmd.exe" called "CreateProcessW" with parameter "findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn"" - (UID: 00000000-00008020) "cmd.exe" called "CreateProcessW" with parameter "cmd /c md 87966" - (UID: 00000000-00008020) "cmd.exe" called "CreateProcessW" with parameter "extrac32 /Y /E Passwords.m4a" - (UID: 00000000-00008020) "cmd.exe" called "CreateProcessW" with parameter "findstr /V "float" Blind" - (UID: 00000000-00008020) "cmd.exe" called "CreateProcessW" with parameter "cmd /c copy /b ..\Howard.m4a + ..\Cannon.m4a + ..\Cherry.m4a + ..\Limit.m4a + ..\Motor.m4a + ..\Assess.m4a + ..\Tires.m4a + ..\Ab" - (UID: 00000000-00008020) "cmd.exe" called "CreateProcessW" with parameter "Solved.com n" - (UID: 00000000-00008020) "cmd.exe" called "CreateProcessW" with parameter "choice /d y /t 5" - (UID: 00000000-00008020) "Solved.com" called "CreateProcessW" with parameter "cmd /k echo [InternetShortcut] > "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\DataDash.url" & e" - (UID: 00000000-00006608) "Solved.com" called "CreateProcessW" with parameter "%TEMP%\87966\RegAsm.exe" - (UID: 00000000-00006608)49:T687,"cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: ""; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KINDMAP"; Key: ""; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "OPEN"; Path: "HKCU\.EXE"; Key: ""; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.EXE"; Key: ""; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\"; Key: ""; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: ""; Value: "")4a:T458,Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp")4b:T513,"cac213f52f629a3b514dfbe6f6aed65f.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "cac213f52f629a3b514dfbe6f6aed65f.exe" touched file "C:\Windows\AttitudeIntegrate" "cac213f52f629a3b514dfbe6f6aed65f.exe" touched file "C:\Windows\GreeceWelding" "cac213f52f629a3b514dfbe6f6aed65f.exe" touched file "C:\Windows\CommandsRope" "cac213f52f629a3b514dfbe6f6aed65f.exe" touched file "C:\Windows\MaineDonation" "cac213f52f629a3b514dfbe6f6aed65f.exe" touched file "C:\Windows\OrgEssay" "cac213f52f629a3b514dfbe6f6aed65f.exe" touched file "C:\Windows\ConsultationLand" "cac213f52f629a3b514dfbe6f6aed65f.exe" touched file "C:\Windows\ChocolateRwanda" "cac213f52f629a3b514dfbe6f6aed65f.exe" touched file "C:\Windows\UsefulCommon" "cac213f52f629a3b514dfbe6f6aed65f.exe" touched file "C:\Windows\BeingInvalid" "cac213f52f629a3b514dfbe6f6aed65f.exe" touched file "C:\Windows\WholeHire" "cac213f52f629a3b514dfbe6f6aed65f.exe" touched file "C:\Windows\PotatoAbsolutely" "cac213f52f629a3b514dfbe6f6aed65f.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cmd.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataDash.url" "cmd.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\DataDash.url"4c:T4f4,Spawned process "cmd.exe" with commandline "/c copy Ind.m4a Ind.m4a.bat & Ind.m4a.bat" (UID: 00000000-00008020) Spawned process "tasklist.exe" (UID: 00000000-00000752) Spawned process "findstr.exe" with commandline "findstr /I "opssvc wrsa"" (UID: 00000000-00003088) Spawned process "tasklist.exe" (UID: 00000000-00005364) Spawned process "findstr.exe" with commandline "findstr "bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn ..." (UID: 00000000-00000724), Spawned process "cmd.exe" with commandline "cmd /c md 87966" (UID: 00000000-00003864), Spawned process "extrac32.exe" with commandline "extrac32 /Y /E Passwords.m4a" (UID: 00000000-00004888), Spawned process "findstr.exe" with commandline "findstr /V "float" Blind" (UID: 00000000-00006740), Spawned process "cmd.exe" with commandline "cmd /c copy /b ..\\Howard.m4a + ..\\Cannon.m4a + ..\\Cherry.m4a ..." (UID: 00000000-00000208), Spawned process "Solved.com" with commandline "n" (UID: 00000000-00006608), Spawned process "cmd.exe" with commandline "cmd /k echo [InternetShortcut] > "%APPDATA%\\Microsoft\\Windows\ ..." (UID: 00000000-00000268) Spawned process "choice.exe" with commandline "choice /d y /t 5" (UID: 00000000-00004588) Spawned process "RegAsm.exe" (UID: 00000000-00003344)4d:T4c4,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003820.00000000.144752.00E1D000.00000002.mdmp") Found reference to API "tWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00003820.00000002.148598.03920000.00000004.mdmp")4e:T56e,Process "cmd.exe" (UID: 00000000-00008020) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00008020) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "tasklist.exe" (UID: 00000000-00000752) was launched with new environment variables: "Passive="F", Aspect="k", Alumni="m", Seekers="Y", Direct="s", Charlie="c", Equally="a", KcGLgnclmSi="Solved.com", Audience="U", Crops="J", Chapel="2", Deep="R", Shoe="Q", Beijing="i", PLlndONpwDPwZjohaImiBKjXmNQOAyOWzP="5", Man="t", Seq="A", Strips="P", Upgrades="u", Profits="4", PROMPT="$P$G", Au="C", Zu="/", Fun="l", Cats="j", Ham="L", Climb="v", Fire="x", Jet="D", Incorporated="E", Reggae="K", Saint="r", Isaac="3", Intelligence="7", Nails="M", Spa="X", Discussions="Z", Governments="g", Wines="0", Introduce="N", Confidence="8", Bronze="W", Shift="y", Belkin="f", Calgary="V", Inspection="H", Free="B", Brand="T", Texas="S", Sheffield="e", Replication="5", Option="z", Inc="d", Combine="n", Attachments="9", Lanka="G", Amended="o", Burst="h", Controls="1", Zero="O", Survivors="p", Increase="w", Clarity=".", Pubmed="6", Fails="q", Madness="I"" Process "tasklist.exe" (UID: 00000000-00005364) was launched with new environment variables: "Subsequent="87966""4f:T77d,Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")50:T587,"tasklist.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "tasklist.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WBEM\CIMOM") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WBEM\CIMOM") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "tasklist.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT")51:T5c3,RegDeleteKeyW RegCloseKey RegOpenKeyExW RegCreateKeyExW RegDeleteValueW RegEnumKeyW GetTempFileNameW LoadLibraryW GetTickCount GetFileSize CreateFileW GetSystemDirectoryW CreateThread WriteFile GetTempPathW LoadLibraryExW GetProcAddress GetModuleFileNameW FindNextFileW CreateDirectoryW LoadLibraryA FindFirstFileW GetFileAttributesW GetModuleHandleA GetModuleHandleW GetVersionExW DeleteFileW OpenProcess CreateProcessW GetCommandLineW CopyFileW Sleep ShellExecuteW FindWindowExW CreateProcessWithLogonW SetSecurityDescriptorDacl GetUserNameW OpenProcessToken CreateProcessAsUserW RegEnumKeyExW IcmpSendEcho ReadProcessMemory OutputDebugStringW VirtualAlloc IsDebuggerPresent GetStartupInfoW DeviceIoControl Process32NextW CopyFileExW WriteProcessMemory GetModuleHandleExW TerminateProcess GetCommandLineA FindFirstFileExW GetSystemInfo ExitThread GetDriveTypeW GetComputerNameW UnhandledExceptionFilter LockResource VirtualAllocEx CreateToolhelp32Snapshot Process32FirstW FindResourceExW ShellExecuteExW SetKeyboardState FindWindowW GetClipboardData GetCursorPos GetWindowThreadProcessId InternetOpenUrlW InternetCloseHandle InternetConnectW FtpOpenFileW HttpQueryInfoW InternetCrackUrlW InternetQueryOptionW InternetOpenW HttpSendRequestW InternetReadFile FtpGetFileSize InternetQueryDataAvailable bind accept closesocket recv WSAStartup listen recvfrom socket send sendto connect52:T6d2,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")53:T6dc,Found reference to API "GetDC" (Indicator: "GetDC"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")54:T5a3,Observed system executable string:"%WINDIR%\SysWOW64\cmd.exe" [Source: 00000000-00007484-00000BC0-1547062273] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00007484-00000C46-4897795282] Observed system executable string:""%WINDIR%\system32\cmd.exe" /c copy Ind.m4a Ind.m4a.bat & Ind.m4a.bat" [Source: 00000000-00007484-00000C46-4897795282] Observed system executable string:"%WINDIR%\SysWOW64\tasklist.exe" [Source: 00000000-00008020-00000BC0-1557551958] Observed system executable string:"%WINDIR%\SysWOW64\findstr.exe" [Source: 00000000-00008020-00000BC0-1557596043] Observed system executable string:"%WINDIR%\SysWOW64\extrac32.exe" [Source: 00000000-00008020-00000BC0-1568898444] Observed system executable string:"%WINDIR%\SysWOW64\choice.exe" [Source: 00000000-00008020-00000BC0-1574898808] Observed system executable string:"%WINDIR%\system32\tasklist.exe" [Source: 00000000-00008020-00000C46-25001814012] Observed system executable string:"%WINDIR%\system32\findstr.exe" [Source: 00000000-00008020-00000C46-25103273796] Observed system executable string:"%WINDIR%\system32\extrac32.exe" [Source: 00000000-00008020-00000C46-52236378192] Observed system executable string:"%WINDIR%\system32\choice.exe" [Source: 00000000-00008020-00000C46-66631979610] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" [Source: 00000000-00006608-00000C2D-114743603400]55:T7c0,"cac213f52f629a3b514dfbe6f6aed65f.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5267920'}" (UID: 00000000-00001328) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5267856'}" (UID: 00000000-00001328) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5267872'}" (UID: 00000000-00001328) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "LoadResource with parameter {'hModule': '1970536448', 'hResInfo': '1902064'}" (UID: 00000000-00001328) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5267888'}" (UID: 00000000-00001328) "extrac32.exe" called "LoadResource with parameter {'hModule': '1970536448', 'hResInfo': '1115664'}" (UID: 00000000-00004948) "Solved.com" called "LoadResource with parameter {'hModule': '18284544', 'hResInfo': '19158424'}" (UID: 00000000-00005048) "Solved.com" called "LoadResource with parameter {'hModule': '18284544', 'hResInfo': '19158200'}" (UID: 00000000-00005048) "Solved.com" called "LoadResource with parameter {'hModule': '18284544', 'hResInfo': '19158456'}" (UID: 00000000-00005048) "Solved.com" called "LoadResource with parameter {'hModule': '18284544', 'hResInfo': '19158264'}" (UID: 00000000-00005048) "Solved.com" called "LoadResource with parameter {'hModule': '18284544', 'hResInfo': '19158440'}" (UID: 00000000-00005048) "Solved.com" called "LoadResource with parameter {'hModule': '18284544', 'hResInfo': '19158248'}" (UID: 00000000-00005048) "Solved.com" called "LoadResource with parameter {'hModule': '18284544', 'hResInfo': '19158216'}" (UID: 00000000-00005048) "Solved.com" called "LoadResource with parameter {'hModule': '18284544', 'hResInfo': '19158472'}" (UID: 00000000-00005048) "Solved.com" called "LoadResource with parameter {'hModule': '18284544', 'hResInfo': '19158232'}" (UID: 00000000-00005048)56:T6e6,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")57:T1073,"cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ALLOWFILECLSIDJUNCTIONS"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ALLOWFILECLSIDJUNCTIONS"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KINDMAP"; Key: ".EXE"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.EXE"; Key: "CONTENT TYPE"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "DONTSHOWSUPERHIDDEN"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "DONTSHOWSUPERHIDDEN"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "SHELLSTATE"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOWEBVIEW"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOWEBVIEW"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "CLASSICSHELL"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "CLASSICSHELL"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "SEPARATEPROCESS"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "SEPARATEPROCESS"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NONETCRAWLING"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NONETCRAWLING"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: "HIDDEN"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: "SHOWCOMPCOLOR"; Value: "") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: "HIDEFILEEXT"; Value: "")58:Tf8b,Observed system executable string:"%WINDIR%\system32\Winsta.dll" [Source: 00000000-00000752-00000C2A-1558110854] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003344-00000C2D-1649081824] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003344-00000C2A-1701479279] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003344-00000C2A-1701676051] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003344-00000C2A-1701761477] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003344-00000C2A-1702029239] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003344-00000C2A-1702070091] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00003344-00000C2A-1702157953] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003344-00000C2A-1702307670] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003344-00000C2A-1702383997] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00003344-00000C2A-1702485930] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003344-00000C2A-1702774179] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00003344-00000C2A-1702913254] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003344-00000C2A-1703132014] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00003344-00000C2A-1703318572] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00003344-00000C2A-1703464341] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00003344-00000C2A-1705960089] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003344-00000C2A-1706302163] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003344-00000C2A-1707836522] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003344-00000C2A-1707910659] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003344-00000C2A-1708088269] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00003344-00000C2A-1739288393] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" [Source: 00000000-00003344-00000C2A-1739554263] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003344-00000C2A-1741627420] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00003344-00000C2A-1741896782]59:T5be,Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "RegConnectRegistryW" (Indicator: "RegConnectRegistry"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "RegConnectRegistryW" (Indicator: "RegConnectRegistry"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")5a:T4e4,Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")5b:Tfbc,Heuristic match: "x5.pw" Heuristic match: "]lr=k.ma" Pattern match: "http://nsis.sf.net/nsis_error" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h" Pattern match: "k.dsnw/g*}qw" Pattern match: "lu.frb/|a?n8&nt=" Pattern match: "a.rn/iroz#91/q'a]ol(4)g4" Pattern match: "to.qwi/:]vcnfagv~/ssy*6@dw^`l@2m1n*/9oxq_%84z" Pattern match: "b7n-roy.mo/4y]hlxw;dff2apz3@#30c3ug$x3ycyb+lr^epnp#zj?gcywjd=*vzfwvl!/g_" Pattern match: "xxza-pk.nyg/1f!$fgkhn*rma}swpcq*zs{n2s" Pattern match: "zdaeivg.cav/o]nm{vc]kul6^qv?y?k6mrw6fwvf1bl[$@w0t" Pattern match: "www.youtube.com/watch?v=9bzkp7q19f0###" Heuristic match: "%temp%\87966\solved.com" Heuristic match: "solved.com" Heuristic match: "%localappdata%\datadive technologies\datadash.com" Pattern match: "https://user-images.githubusercontent.com/45857590/138568746-1a5578fe-f51b-4114-bcf2-e374535f848" Heuristic match: "kcglgnclmsi=solved.com" Heuristic match: "i=solved.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "c:\users\hapubws\appdata\local\temp\87966\solved.com" Heuristic match: "cglgnclmsi=solved.com" Heuristic match: ":\users\hapubws\appdata\local\temp\87966\solved.com" Heuristic match: "device\harddiskvolume2\users\hapubws\appdata\local\temp\87966\solved.com" Heuristic match: "7966\solved.com" Heuristic match: "local\temp\87966\solved.com" Heuristic match: "ata\local\temp\87966\solved.com" Heuristic match: "mp\87966\solved.com" Heuristic match: "appdata\local\temp\87966\solved.com" Heuristic match: ":\users\hapubws\appdata\local\datadive technologies\datadash.com" Pattern match: "http://ocsp2.globalsign.com/rootr306" Pattern match: "http://crl.globalsign.com/root-r3.crl0c" Pattern match: "https://www.globalsign.com/repository/0" Pattern match: "http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08" Pattern match: "http://ocsp2.globalsign.com/gscodesignsha2g30v" Pattern match: "http://crl.globalsign.com/gscodesignsha2g3.crl0" Pattern match: "https://www.autoitscript.com/autoit3/" Pattern match: "http://ocsp.globalsign.com/ca/gstsacasha384g40c" Pattern match: "secure.globalsign.com/cacert/gstsacasha384g4.crt0" Pattern match: "crl.globalsign.com/ca/gstsacasha384g4.crl0" Pattern match: "http://ocsp2.globalsign.com/rootr606" Pattern match: "http://crl.globalsign.com/root-r6.crl0g" Pattern match: "http://crl.globalsign.com/root-r3.crl0g" Pattern match: "http://www.autoitscript.com/autoit3/" Heuristic match: "pdata\local\temp\87966\solved.com" Heuristic match: "66\solved.com" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/primarycps.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@"5c:T5fb,"cac213f52f629a3b514dfbe6f6aed65f.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00007484) "cac213f52f629a3b514dfbe6f6aed65f.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00007484) "Solved.com" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\DataDive Technologies (UID: 00000000-00006608) "RegAsm.exe" called "CreateDirectoryW" with parameter %APPDATA%\7n5rJCiEX08cdKRQsT6vxkbuaZ (UID: 00000000-00003344) "RegAsm.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\b8755439bbaef8499326d21b38ff3487 (UID: 00000000-00003344) "RegAsm.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\b8755439bbaef8499326d21b38ff3487\logs (UID: 00000000-00003344) "RegAsm.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\b8755439bbaef8499326d21b38ff3487\logs\clipboard (UID: 00000000-00003344) "RegAsm.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\b8755439bbaef8499326d21b38ff3487\logs\clipboard\2025-06-01 (UID: 00000000-00003344)5d:T5fa,Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")5e:Tbad,Dropped file "%LOCALAPPDATA%\DataDive Technologies\S" has high entropy 7.999930966529567 Dropped file "%TEMP%\Passwords.m4a" has high entropy 7.9987884241291525 Dropped file "%TEMP%\Baking.m4a" has high entropy 7.998547402194347 Dropped file "%TEMP%\Assess.m4a" has high entropy 7.997908838032466 Dropped file "%TEMP%\Rid.m4a" has high entropy 7.998021458836599 Dropped file "%TEMP%\Catch.m4a" has high entropy 7.9983461362369574 Dropped file "%TEMP%\Tires.m4a" has high entropy 7.997833691319047 Dropped file "%TEMP%\Licenses.m4a" has high entropy 7.997850089479176 Dropped file "%TEMP%\Organisations.m4a" has high entropy 7.997876309589517 Dropped file "%TEMP%\Messages.m4a" has high entropy 7.998070040624793 Dropped file "%TEMP%\Lens.m4a" has high entropy 7.997747093943301 Dropped file "%TEMP%\Mysterious.m4a" has high entropy 7.997687400899328 Dropped file "%TEMP%\Motor.m4a" has high entropy 7.997830579253773 Dropped file "%TEMP%\Motel.m4a" has high entropy 7.998183548107067 Dropped file "%TEMP%\Worldcat.m4a" has high entropy 7.997536302706285 Dropped file "%TEMP%\Cannon.m4a" has high entropy 7.99758902552328 Dropped file "%TEMP%\Latinas.m4a" has high entropy 7.997421167366686 Dropped file "%TEMP%\Cole.m4a" has high entropy 7.997516161033955 Dropped file "%TEMP%\Above.m4a" has high entropy 7.998043554757775 Dropped file "%TEMP%\Parameter.m4a" has high entropy 7.99725652233504 Dropped file "%TEMP%\Blocking.m4a" has high entropy 7.997854402005466 Dropped file "%TEMP%\Five.m4a" has high entropy 7.997319642631771 Dropped file "%TEMP%\Michael.m4a" has high entropy 7.997102557170016 Dropped file "%TEMP%\Ir.m4a" has high entropy 7.996685764972279 Dropped file "%TEMP%\Curves.m4a" has high entropy 7.9975726669320855 Dropped file "%TEMP%\Karma.m4a" has high entropy 7.997435154054043 Dropped file "%TEMP%\Landing.m4a" has high entropy 7.997086914910585 Dropped file "%TEMP%\Cherry.m4a" has high entropy 7.997081629622726 Dropped file "%TEMP%\Ages.m4a" has high entropy 7.99716646742241 Dropped file "%TEMP%\Shuttle.m4a" has high entropy 7.996855004553796 Dropped file "%TEMP%\Damn.m4a" has high entropy 7.997388173859697 Dropped file "%TEMP%\Howard.m4a" has high entropy 7.996792608245995 Dropped file "%TEMP%\Ipaq.m4a" has high entropy 7.996894451331823 Dropped file "%TEMP%\Temple.m4a" has high entropy 7.996362269747699 Dropped file "%TEMP%\Hydrocodone.m4a" has high entropy 7.996663256899416 Dropped file "%TEMP%\Knit.m4a" has high entropy 7.996718108415918 Dropped file "%TEMP%\Garage.m4a" has high entropy 7.99671015666925 Dropped file "%TEMP%\Pay.m4a" has high entropy 7.996575243082218 Dropped file "%TEMP%\Amount.m4a" has high entropy 7.996360891207684 Dropped file "%TEMP%\Limit.m4a" has high entropy 7.996040044664989 Dropped file "%TEMP%\Messenger.m4a" has high entropy 7.996748041922291 Dropped file "%TEMP%\Puzzle.m4a" has high entropy 7.9955724877231305 Dropped file "%TEMP%\87966\n" has high entropy 7.9999309665295675f:T4e5,"cac213f52f629a3b514dfbe6f6aed65f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cac213f52f629a3b514dfbe6f6aed65f.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")60:Tdde,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "Module32NextW" (Indicator: "Module32Next"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "Module32FirstW" (Indicator: "Module32First"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "115194508614,6592,3124,,Process32NextW,kernel32.dll,"00:43:43.109",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006608.00000002.168963.07080000.00000004.mdmp") Found reference to API "115193363708,6592,3124,,Process32NextW,kernel32.dll,"00:43:43.109",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006608.00000002.168963.07080000.00000004.mdmp") Found reference to API "115194778134,6592,3124,,Process32NextW,kernel32.dll,"00:43:43.109",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006608.00000002.168963.07080000.00000004.mdmp") Found reference to API "115192555534,6592,3124,,Process32NextW,kernel32.dll,"00:43:43.109",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00006608.00000002.168963.07080000.00000004.mdmp")61:Ta4e,"cmd /k echo [InternetShortcut] > "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\DataDash.url" & e" (Indicator: "cmd /k echo [internetshortcut] > "%appdata%\microsoft\windows\start menu\programs\startup\datadash.url" & e") in Source: 00000000-00006608-00000C46-7039784464 "cmd /k echo [InternetShortcut] > "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\DataDash.url" & echo URL="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\DataDash.url" & exit" (Indicator: "cmd /k echo [internetshortcut] > "%appdata%\microsoft\windows\start menu\programs\startup\datadash.url" & echo url="%appdata%\microsoft\windows\start menu\programs\startup\datadash.url" & exit") in Source: cmd.exe "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "??\c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00006608.00000000.165120.03330000.00000004.mdmp 00000000-00006608.00000001.167043.03330000.00000004.mdmp 00000000-00006608.00000002.168963.03330000.00000004.mdmp "md /k echo [InternetShortcut] > "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataDash.url" & echo URL="C:\Users\HAPUBWS\AppData\Local\DataDive Technologies\DataDash.js" >> "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataDash.url" & exit" (Indicator: "md /k echo [internetshortcut] > "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\datadash.url" & echo url="c:\users\hapubws\appdata\local\datadive technologies\datadash.js" >> "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\datadash.url" & exit") in Source: 00000000-00006608.00000000.165120.07080000.00000004.mdmp 00000000-00006608.00000001.167043.07080000.00000004.mdmp "\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00006608.00000000.165120.07080000.00000004.mdmp 00000000-00006608.00000001.167043.07080000.00000004.mdmp 00000000-00006608.00000002.168963.07080000.00000004.mdmp "APUBWS\AppData\Local\DataDive Technologies\DataDash.js" >> "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DataDash.url" & exit" (Indicator: "apubws\appdata\local\datadive technologies\datadash.js" >> "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\datadash.url" & exit") in Source: 00000000-00006608.00000000.165120.07080000.00000004.mdmp 00000000-00006608.00000001.167043.07080000.00000004.mdmp62:T537,"cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\MIRC" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\BLOCKING.M4A" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Blocking.m4a" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MYSTERIOUS.M4A" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Mysterious.m4a" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\CANNON.M4A" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Cannon.m4a" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\FUNCTIONSWITHINDELIVERYRANGERSTELEPHONYRIVERSIDE" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\FunctionsWithinDeliveryRangersTelephonyRiverside" "cac213f52f629a3b514dfbe6f6aed65f.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\FunctionsWithinDeliveryRangersTelephonyRiverside\"63:T4a0,Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")64:T580,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "cac213f52f629a3b514dfbe6f6aed65f.exe") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00006608.00000002.168963.00A0D000.00000002.mdmp")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["evasive"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"Cannon.m4a","sha256":"33cda8611c118c4e9b299d6799896f0b907d6aa78b5ee614dce11002fb2524ec","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"S","sha256":"7227acc1765bafec36363cddb6650cb6a28b89c424e297798b442eb5653b0756","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Assess.m4a","sha256":"6b56515c67b7aa52f44dfbfdb5124d2e2931774028d906a18bbaca21d2f2ffca","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"DataDash.url","sha256":"685b52cb67fd8832b084f6563b83ed631945140b2c07912e08b246e2299db8f7","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Continuity","sha256":"340e8d2ec4a399eed677be04bd97d61d4375fc259c58baaab3b8c987d13c84c4","sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Boulder","sha256":"b1d9765332e48d2d70d28941c5984f9e4a4677c2a095ca57d47a214e9456ac83","sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"clipboard_logs.txt","sha256":"c2f9aa98a078866350f07d1d163e14ad25bd70c206e12de62d21295e4e9e36eb","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Finder-Latest.log","sha256":"ea9c0cce04f93fc53469da31ddbbd34001ecfb293d88728ff11f5bef37bb8c30","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"verdict":"undetected"},{"name":"n","sha256":"7227acc1765bafec36363cddb6650cb6a28b89c424e297798b442eb5653b0756","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Chef","sha256":"d4bae0a5a25a6c5f6526d3db3db40edde71759ee497782a7089fc819abd7c35b","sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Cole.m4a","sha256":"34bf7d4e6dd9f1f8c3b74a974aebe161b55f42a3ff5c45df63e581ec077ef0f7","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Catch.m4a","sha256":"c452085a240d3ae112a1a21bc22b3051d4ad8be2bfe166a40352c177dcf595d3","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Curves.m4a","sha256":"ef059dcf97f5c15d6833c522944d3ac2889d11ba0836fe124c52e150ef49711b","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Solved.com","sha256":"1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Above.m4a","sha256":"05177612a89af520864d0149430fc74e7b35fce7b843d2a983c8fd07c41b2594","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"DataDash.js","sha256":"9802f43123729707cac37e8709af9db8d3f62a0c7c8ce002a8cabfd4832ba528","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"DataDash.com","sha256":"1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Amount.m4a","sha256":"b6fe5f9a710885d0764f8f49191317a043c0c1120ea5dc4009d5093a7cfc2eb7","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Damn.m4a","sha256":"e0df4037e0822fe0627e83dda79b7a9e7454d8a122456bd433baa654147ee773","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"verdict":"undetected"},{"name":"RegAsm.exe","sha256":"d2f0b87e2d2707685c4d35f8f05b42fb8326ef4e70d16097b8837daba06ac961","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Baking.m4a","sha256":"0679a8b690e5f7621d9a9e67a0017494807c02ed29b9dc91e61ba4143347dc83","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Five.m4a","sha256":"1639f672a3eec35b1e7b43caae8284eac91185abc31f55efeabf5a582db2d100","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Ages.m4a","sha256":"e9c2239b5c066448332e793b84063618f9c394304b19af1c9f815aac9a430164","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Ind.m4a.bat","sha256":"d8e33c9879d0323a47383abd5c47d6a7a33ff2d73a7908451ac7fe85e834c88a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Blocking.m4a","sha256":"38f684cbba40f974f4a90ef63005ff3f6c9fbe7de6456363a9ad9f2a73f3f334","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Cherry.m4a","sha256":"f5edf74822875e6bac1960d50b36d9de24a1c6a69653a2d555b3e55cb31662dd","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%TEMP%\\Messenger.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\25674be0654ca83e251e20ef5708b333\\logs\\clipboard\\2025-06-01\\clipboard_logs.txt","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\DataDash.url","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%WINDIR%\\UsefulCommon","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"path":"%TEMP%\\87966\\n","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Karma.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Licenses.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%WINDIR%\\OrgEssay","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\DataDive Technologies\\S","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Motel.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Shuttle.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\nsj201.tmp","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Limit.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\nscE788.tmp","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"path":"%TEMP%\\Rid.m4a","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"path":"%TEMP%\\Damn.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Passwords.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Ipaq.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Pay.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Ind.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Knit.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Five.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Michael.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"path":"%TEMP%\\Parameter.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%APPDATA%\\Finder-Latest.log","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"path":"%TEMP%\\Amount.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%WINDIR%\\MaineDonation","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Catch.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Howard.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Ages.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Tires.m4a","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"path":"%TEMP%\\Latinas.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\DataDive Technologies\\DataDash.com","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\b8755439bbaef8499326d21b38ff3487\\logs\\clipboard\\2025-06-01\\clipboard_logs.txt","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"path":"%TEMP%\\Blocking.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Ind.m4a.bat","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Baking.m4a","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"path":"%TEMP%\\Puzzle.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%WINDIR%\\PotatoAbsolutely","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"path":"%TEMP%\\Lens.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\nsaE436.tmp","sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"}]},{"path":"%TEMP%\\Motor.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%WINDIR%\\BeingInvalid","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"path":"%WINDIR%\\AttitudeIntegrate","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Cole.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\DataDive Technologies\\DataDash.js","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Above.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Organisations.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Mysterious.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%WINDIR%\\WholeHire","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"path":"%TEMP%\\Temple.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"C:\\Users","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%WINDIR%\\CommandsRope","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%WINDIR%\\ChocolateRwanda","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"path":"%TEMP%\\Garage.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Ir.m4a","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"path":"%TEMP%\\nsl5DA9.tmp","sources":[{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"path":"%WINDIR%\\GreeceWelding","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Curves.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Assess.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Messages.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Worldcat.m4a","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"path":"%WINDIR%\\ConsultationLand","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Landing.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Cherry.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Cannon.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\87966\\RegAsm.exe","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\nsdF6AD.tmp","sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"path":"%TEMP%\\Hydrocodone.m4a","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1524:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7184:64:WilError_03","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"Local\\SM0:7484:168:WilStaging_02","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3508:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"Local\\SM0:3508:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2732:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6412:64:WilError_03","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"Local\\SM0:3344:168:WilStaging_02","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3344:168:WilStaging_02","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:752:168:WilStaging_02","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"Local\\SM0:7184:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"Local\\SM0:2732:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"SM0:7184:64:WilError_03","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7484:64:WilError_01","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7484:168:WilStaging_02","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\kYWX8gW3tZWJn40STlpUSedSUspUJS5MDrT8zpGIMKPT+XXkDLMCgNOL/9iFg3idkuXV93w7v7d1v0w0xqLVgw==","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4152:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"Local\\SM0:5952:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"Local\\SM0:7184:64:WilError_03","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"SM0:3344:64:WilError_01","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"kYWX8gW3tZWJn40STlpUSedSUspUJS5MDrT8zpGIMKPT+XXkDLMCgNOL/9iFg3idkuXV93w7v7d1v0w0xqLVgw==","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"SM0:7484:64:WilError_01","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5952:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7720:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"Local\\SM0:7484:64:WilError_01","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"Local\\SM0:6412:64:WilError_03","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"SM0:752:168:WilStaging_02","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5364:168:WilStaging_02","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7184:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"SM0:7720:64:WilError_03","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"Local\\SM0:6412:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7484:64:WilError_01","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"Local\\SM0:1524:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"name":"SM0:5364:168:WilStaging_02","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7720:64:WilError_03","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7184:64:WilError_03","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3344:64:WilError_01","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"SM0:6412:64:WilError_03","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6412:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"name":"Local\\SM0:4152:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"SM0:1524:64:WilError_03","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6412:64:WilError_03","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"Local\\SM0:7720:168:WilStaging_02","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1524:64:WilError_03","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"176.65.134.10","country":"Germany","port":4449,"protocol":"TCP","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]}],"dns_resolutions":[{"country":"-","domain":"TvoIIdkJjszTbBl.TvoIIdkJjszTbBl","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]}],"http_requests":[]},"process_activity":{"all_imported_dlls":["srvcli.dll","rsaenh.dll","mscoree.dll","CoreUIComponents.dll","clr.dll","user32.dll","shlwapi.dll","msIso.dll","msls31.dll","netutils.dll","comctl32.dll","framedynos.dll","System.Configuration.ni.dll","sfc_os.dll","TextInputFramework.dll","virtdisk.dll","cmdext.dll","NapiNSP.dll","rasadhlp.dll","comdlg32.dll","mswsock.dll","normaliz.dll","cfgmgr32.dll","ole32.dll","cldapi.dll","MpOAV.dll","wbemcomn.dll","ntmarta.dll","advapi32.dll","kernel.appcore.dll","riched20.dll","imm32.dll","ucrtbase_clr0400.dll","System.Core.ni.dll","gdi32full.dll","oleaut32.dll","VxSSL32.dll","setupapi.dll","wsock32.dll","aepic.dll","winrnr.dll","powrprof.dll","cryptsp.dll","bcrypt.dll","fltLib.dll","amsi.dll","win32u.dll","System.Management.dll","shell32.dll","sechost.dll","api-ms-win-core-synch-l1-2-0.dll","winbrand.dll","wkscli.dll","mpr.dll","System.ni.dll","mscoreei.dll","BCP47Langs.dll","propsys.dll","msctf.dll","shfolder.dll","Accessibility.dll","System.Windows.Forms.dll","cryptbase.dll","wow64base.dll","nsi.dll","version.dll","System.Xml.ni.dll","KernelBase.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","cabinet.dll","winmm.dll","wldp.dll","CoreMessaging.dll","winsta.dll","profapi.dll","fastprox.dll","windows.storage.dll","dnsapi.dll","WMINet_Utils.dll","wbemcomn2.dll","winmmbase.dll","msvcp_win.dll","nlaapi.dll","lpk.dll","rpcss.dll","RpcRtRemote.dll","rpcrt4.dll","wow64.dll","wow64win.dll","userenv.dll","WinTypes.dll","ucrtbase.dll","urlmon.dll","pnrpnsp.dll","iertutil.dll","AppResolver.dll","dbghelp.dll","ntdll.dll","netapi32.dll","msasn1.dll","winnsi.dll","gdi32.dll","imagehlp.dll","SHCore.dll","wbemsvc.dll","ws2_32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","OneCoreUAPCommonProxyStub.dll","clrjit.dll","msvcrt.dll","uxtheme.dll","clbcatq.dll","AcLayers.dll","wmiutils.dll","TextShaping.dll","sspicli.dll","vcruntime140_clr0400.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","dwmapi.dll","wininet.dll","api-ms-win-downlevel-version-l1-1-0.dll","System.Drawing.dll","apphelp.dll","samcli.dll","usp10.dll","Windows.StateRepositoryPS.dll","ntdsapi.dll","wow64cpu.dll","secur32.dll","wbemprox.dll","kernel32.dll","psapi.dll","edputil.dll","bcryptprimitives.dll","api-ms-win-downlevel-user32-l1-1-0.dll","IPHLPAPI.DLL","nlansp_c.dll","Wldap32.dll","sfc.dll","wow64con.dll","combase.dll","devobj.dll","crypt32.dll","wshbth.dll","mscorlib.ni.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll"],"processes":[{"command_line":"","icon":"$22","name":"cac213f52f629a3b514dfbe6f6aed65f.exe","normalized_path":"C:\\cac213f52f629a3b514dfbe6f6aed65f.exe","pid":7484,"ppid":0,"sha256":"899ce99aa7fda10c1b37b29f2353d3fd9f91e4119292bd437ab6a8c5066cafa0","uid":"00000000-00007484"},{"command_line":"/c copy Ind.m4a Ind.m4a.bat & Ind.m4a.bat","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00007484","pid":8020,"ppid":7484,"sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","uid":"00000000-00008020"},{"command_line":"","name":"tasklist.exe","normalized_path":"%WINDIR%\\SysWOW64\\tasklist.exe","parent_uid":"00000000-00008020","pid":752,"ppid":8020,"sha256":"cc87ad2c2a96507d33a0a7e09f1e42d19c7e2aa26a4071a4d8e9dd096ebcf33e","uid":"00000000-00000752"},{"command_line":"findstr /I \"opssvc wrsa\"","name":"findstr.exe","normalized_path":"%WINDIR%\\SysWOW64\\findstr.exe","parent_uid":"00000000-00008020","pid":3088,"ppid":8020,"sha256":"3a325a8337486df63a0ce02de757a5bc417fa7f9ab6f62d8f46b9be54766fc01","uid":"00000000-00003088"},{"command_line":"","name":"tasklist.exe","normalized_path":"%WINDIR%\\SysWOW64\\tasklist.exe","parent_uid":"00000000-00008020","pid":5364,"ppid":8020,"sha256":"cc87ad2c2a96507d33a0a7e09f1e42d19c7e2aa26a4071a4d8e9dd096ebcf33e","uid":"00000000-00005364"},{"command_line":"findstr \"bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn\"","name":"findstr.exe","normalized_path":"%WINDIR%\\SysWOW64\\findstr.exe","parent_uid":"00000000-00008020","pid":724,"ppid":8020,"sha256":"3a325a8337486df63a0ce02de757a5bc417fa7f9ab6f62d8f46b9be54766fc01","uid":"00000000-00000724"},{"command_line":"cmd /c md 87966","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00008020","pid":3864,"ppid":8020,"sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","uid":"00000000-00003864"},{"command_line":"extrac32 /Y /E Passwords.m4a","name":"extrac32.exe","normalized_path":"%WINDIR%\\SysWOW64\\extrac32.exe","parent_uid":"00000000-00008020","pid":4888,"ppid":8020,"sha256":"41cd52e4f1018a23e39a5ab2a647b0993cc2c2f04ec87175ff452caf6956902e","uid":"00000000-00004888"},{"command_line":"findstr /V \"float\" Blind","name":"findstr.exe","normalized_path":"%WINDIR%\\SysWOW64\\findstr.exe","parent_uid":"00000000-00008020","pid":6740,"ppid":8020,"sha256":"3a325a8337486df63a0ce02de757a5bc417fa7f9ab6f62d8f46b9be54766fc01","uid":"00000000-00006740"},{"command_line":"cmd /c copy /b ..\\Howard.m4a + ..\\Cannon.m4a + ..\\Cherry.m4a + ..\\Limit.m4a + ..\\Motor.m4a + ..\\Assess.m4a + ..\\Tires.m4a + ..\\Above.m4a + ..\\Baking.m4a + ..\\Rid.m4a + ..\\Blocking.m4a + ..\\Landing.m4a + ..\\Temple.m4a + ..\\Damn.m4a + ..\\Mysterious.m4a + ..\\Michael.m4a + ..\\Curves.m4a + ..\\Worldcat.m4a + ..\\Karma.m4a + ..\\Shuttle.m4a + ..\\Pay.m4a + ..\\Messages.m4a + ..\\Amount.m4a + ..\\Five.m4a + ..\\Motel.m4a + ..\\Latinas.m4a + ..\\Messenger.m4a + ..\\Lens.m4a + ..\\Hydrocodone.m4a + ..\\Organisations.m4a + ..\\Cole.m4a + ..\\Ipaq.m4a + ..\\Licenses.m4a + ..\\Catch.m4a + ..\\Garage.m4a + ..\\Knit.m4a + ..\\Ages.m4a + ..\\Parameter.m4a + ..\\Ir.m4a + ..\\Puzzle.m4a n","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00008020","pid":208,"ppid":8020,"sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","uid":"00000000-00000208"},{"command_line":"n","name":"Solved.com","normalized_path":"%TEMP%\\87966\\Solved.com","parent_uid":"00000000-00008020","pid":6608,"ppid":8020,"sha256":"1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49","uid":"00000000-00006608"},{"command_line":"","name":"RegAsm.exe","normalized_path":"%TEMP%\\87966\\RegAsm.exe","parent_uid":"00000000-00006608","pid":3344,"ppid":6608,"sha256":"d2f0b87e2d2707685c4d35f8f05b42fb8326ef4e70d16097b8837daba06ac961","uid":"00000000-00003344"},{"command_line":"choice /d y /t 5","name":"choice.exe","normalized_path":"%WINDIR%\\SysWOW64\\choice.exe","parent_uid":"00000000-00008020","pid":4588,"ppid":8020,"sha256":"f11a3916e2a4d93d823dfcfb043048b49bac84340037f438c96b2af6602719b6","uid":"00000000-00004588"},{"command_line":"cmd /k echo [InternetShortcut] > \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\DataDash.url\" & echo URL=\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\DataDash.url\" & exit","icon":"$23","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","pid":268,"ppid":0,"sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","uid":"00000000-00000268"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\SYNCROOTMANAGER\\\\","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]}],"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]}],"keys_modified":[]},"sample_flags":["Network Traffic","Extracted Files","Multi-Process"],"sandbox_reports":[{"analysis_start_time":"2026-02-25T15:39:38+00:00","environment_description":"Windows 7 64 bit","environment_id":120,"id":"699f17b924002f0eb60300d2","indicators_count":{"informative":208,"malicious":8,"suspicious":30},"is_in_unified_schema":true,"malware_family":"Trojan.Generic","state":"SUCCESS","submit_name":"cac213f52f629a3b514dfbe6f6aed65f.exe","tags":["Multi-Process","Network Traffic","Extracted Files"],"threat_score":100,"verdict":"malicious"},{"analysis_start_time":"2025-06-01T19:39:49+00:00","environment_description":"Windows 7 64 bit","environment_id":120,"id":"683cac84e502a202780af456","indicators_count":{"informative":231,"malicious":9,"suspicious":56},"is_in_unified_schema":false,"state":"SUCCESS","submit_name":"cac213f52f629a3b514dfbe6f6aed65f.exe","tags":["Multi-Process","Network Traffic","Extracted Files"],"threat_score":100,"verdict":"malicious"},{"analysis_start_time":"2025-06-01T19:39:42+00:00","environment_description":"Windows 7 32 bit (HWP Support)","environment_id":110,"id":"683cac7e0c80f88e3a004694","indicators_count":{"informative":226,"malicious":8,"suspicious":53},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"cac213f52f629a3b514dfbe6f6aed65f.exe","tags":["Multi-Process","Network Traffic","Extracted Files"],"threat_score":100,"verdict":"malicious"},{"analysis_start_time":"2025-06-01T19:39:37+00:00","environment_description":"Windows 7 32 bit","environment_id":100,"id":"683cac7829d589f4cc05b986","indicators_count":{"informative":227,"malicious":8,"suspicious":52},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"cac213f52f629a3b514dfbe6f6aed65f.exe","tags":["Multi-Process","Network Traffic","Extracted Files"],"threat_score":100,"verdict":"malicious"},{"analysis_start_time":"2025-06-01T19:39:31+00:00","contacted_countries":["DEU"],"environment_description":"Windows 11 64 bit","environment_id":140,"id":"683cac72742e955ef80403cc","indicators_count":{"informative":211,"malicious":8,"suspicious":56},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"cac213f52f629a3b514dfbe6f6aed65f.exe","tags":["Multi-Process","Network Traffic","Extracted Files"],"threat_score":100,"verdict":"malicious"},{"analysis_start_time":"2025-06-01T19:39:26+00:00","contacted_countries":["DEU"],"environment_description":"Windows 10 64 bit","environment_id":160,"id":"683cac6d0fc0c3b3fd030e37","indicators_count":{"informative":221,"malicious":8,"suspicious":59},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"cac213f52f629a3b514dfbe6f6aed65f.exe","tags":["Multi-Process","Network Traffic","Extracted Files"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":1,"contacted_urls_count":0,"dns_resolutions_count":1,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":26,"files_deleted_count":0,"files_written_count":76,"http_requests_count":0,"imported_dlls_count":146,"injected_processes_count":0,"mutex_created_count":51,"process_count":14,"registry_keys_created_count":6,"registry_keys_deleted_count":4,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"script_calls_count":0,"spawned_processes_count":14}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Trojan.Generic"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Infostealer/Win.Rhadamanthys","verdict":"malicious"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"DR/AVI.Agent.lwxiy","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.GenericKD.76523890","verdict":"malicious"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.GenericKD.76523890 (B)","verdict":"malicious"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Riskware ( 0040eff71 )","verdict":"malicious"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W32/Agent.KMZ.gen!Eldorado","verdict":"malicious"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.NSISDrp.IES","verdict":"malicious"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_56.0","verdict":"malicious"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Backdoor.Agent.Win32.98338","verdict":"malicious"}}},"incidents":[{"details":[{"detail":"Contacts 1 domain and 1 host"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"details":[{"detail":"Sets a global windows hook to intercept keystrokes"},{"detail":"Found a string that may be used as part of an injection method"}],"details_count":2,"name":"Spyware","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Writes a file to the startup folder"}],"details_count":3,"name":"Persistence","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Tries to gather information about running processes on a system"}],"details_count":5,"name":"Fingerprint","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Executes WMI queries known to be used for VM detection"}],"details_count":3,"name":"Evasive","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Domain Generation Algorithms"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Location Discovery"},{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}],"tactic":"Discovery","technique":"Device Driver Discovery"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"suspicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Executes echo command"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection"},{"attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Unsecured Credentials"},{"attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Persistence","technique":"Account Manipulation"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Execution","technique":"Malicious File"},{"attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerade File Type"},{"attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Keylogging"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Impact","technique":"System Shutdown/Reboot"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Calls an API typically used to set the date and time of the file"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Tries to copy files"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"Security Software Discovery"},{"attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Protocols"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Creates a writable file in a temporary directory"},{"type":"informative","value":"Creates directory on disk"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Collection","technique":"Email Collection"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"},{"type":"suspicious","value":"YARA signature match - References common sandbox DLLs (sandbox evasion)"}],"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Reconnaissance","technique":"Gather Victim Network Information"},{"attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Portable Executable Injection"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Bypass User Account Control"},{"attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Connections Discovery"},{"attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Persistence","technique":"Shortcut Modification"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Input Capture"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"malicious","value":"Tries to gather information about running processes on a system"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"suspicious","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Collection","technique":"Archive Collected Data"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads system mouse configuration"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Adjusts debug privileges"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Create Process with Token"},{"attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Mail Protocols"},{"attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"},{"type":"informative","value":"Able to modify Remote Configuration"}],"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Remote Services"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Web Service"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Internal Proxy"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Binary Proxy Execution"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Writes a file to the startup folder"},{"type":"informative","value":"System process creates file in Startup folder"},{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism"},{"attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Asymmetric Cryptography"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Searches for patterns in files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Symmetric Cryptography"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"Domain Groups"},{"attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Hollowing"},{"attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Collection","technique":"Clipboard Data"},{"attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Collection","technique":"Data from Local System"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Application Layer Protocol"},{"attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Encrypted/Encoded File"},{"attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"DNS"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"},{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"Network Share Discovery"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Drops Windows batch files"},{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Contains ability to copy files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Able to download remote files using web shell script"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to block user input (API string)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal"},{"attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Management Instrumentation"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a global windows hook to intercept keystrokes"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credential API Hooking"},{"attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"},{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Reflective Code Loading"},{"attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"Remote System Discovery"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Persistence","technique":"DLL Side-Loading"},{"attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Standard Port"},{"attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Execution","technique":"Command and Scripting Interpreter"},{"attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}],"tactic":"Discovery","technique":"Software Discovery"}],"rule_matches":{},"sandbox_signatures":[{"category":"Cryptographic Related","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP address in binary/memory","id":"summary-31","level":"informative","mitre_attack_id":"T1573.001","name":"Shows ability to use encryption for command and control traffic","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"General","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"Solved.com\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"Solved.com\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"Solved.com\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"RegAsm.exe\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"RegAsm.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"RegAsm.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"tasklist.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\"\n \"RegAsm.exe\" issued a query \"SELECT * FROM Win32_Processor\"\n \"RegAsm.exe\" issued a query \"SELECT * FROM Win32_VideoController\"","id":"api-57","level":"suspicious","mitre_attack_id":"T1047","name":"Executes WMI queries known to be used for VM detection","origin":"API Call","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"General","description":"\"Software\\AutoIt v3\\AutoIt\" in Source: 00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\n \"SOFTWARE\\Classes\\\" in Source: 00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\n \"SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\" in Source: 00000000-00003820.00000000.144752.00E1D000.00000002.mdmp","id":"memorydump-10","level":"informative","mitre_attack_id":"T1012","name":"Found registry location strings in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-545","level":"informative","mitre_attack_id":"T1547.009","name":"Contains ability to register hotkeys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$24","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetModuleHandleA@KERNEL32.DLL at 00000000-00001328-16986-5-00405B93\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001328-16986-16-0040159C\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001328-16986-54-004033E9","id":"stream-121","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"General","description":"\"Solved.com\" searching for class \"Shell_TrayWnd\"","id":"api-70","level":"informative","mitre_attack_id":"T1010","name":"Scanning for window names","origin":"API Call","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Blocking.m4a\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Mysterious.m4a\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cannon.m4a\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Damn.m4a\"","id":"api-267","level":"informative","mitre_attack_id":"T1005","name":"Writes files in a temp directory","origin":"API Call","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"15001600c03e5f6b@ADVAPI32.dll\"\n \"0e000f00703f5f6b@ADVAPI32.dll\"\n \"0e000f00cc3f5f6b@ADVAPI32.dll\"\n \"11001200b4475f6b@ADVAPI32.dll\"\n \"1100120048485f6b@ADVAPI32.dll\"\n \"120013008c485f6b@ADVAPI32.dll\"\n \"12001300e4485f6b@ADVAPI32.dll\"\n \"140015000c705f6b@ADVAPI32.dll\"\n \"1400150024705f6b@ADVAPI32.dll\"\n \"140015003c705f6b@ADVAPI32.dll\"\n \"1700180054705f6b@ADVAPI32.dll\"\n \"0d000e006c705f6b@ADVAPI32.dll\"\n \"110012007c705f6b@ADVAPI32.dll\"\n \"1100120090705f6b@ADVAPI32.dll\"\n \"0d000e0034495f6b@SHELL32.dll\"\n \"0d000e00b0495f6b@SHELL32.dll\"\n \"0f001000d0715f6b@ADVAPI32.dll\"\n \"1400150010725f6b@ADVAPI32.dll\"\n \"1400150028725f6b@ADVAPI32.dll\"\n \"0c000d0070725f6b@ADVAPI32.dll\"\n \"0c000d0080725f6b@ADVAPI32.dll\"\n \"0e000f0090725f6b@ADVAPI32.dll\"\n \"0e000f00a0725f6b@ADVAPI32.dll\"\n \"0b000c00b0725f6b@ADVAPI32.dll\"\n \"18001900e8745f6b@RPCRT4.dll\"","id":"api-8","level":"informative","mitre_attack_id":"T1129","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","origin":"API Call","relevance":1,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-409","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to set file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$25","id":"api-175","level":"informative","mitre_attack_id":"T1129","name":"Calls an API typically used to load libraries","origin":"API Call","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" has an executable section named \".text\"\n \"Solved.com\" has an executable section named \".text\"\n \"RegAsm.exe\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Network Related","description":"\"tasklist.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003260)\n \"tasklist.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003744)","id":"api-219","level":"informative","mitre_attack_id":"T1021","name":"Calls an API typically used to register an interface (RPC)","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$26","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$27","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$28","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"General","description":"$29","id":"string-329","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to copy files","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-413","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to find open windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007484)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008020)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RegAsm.exe\" called \"GetWindowTextW\" with parameter \"Blank page\" - (UID: 00000000-00003344)","id":"api-151","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to get active windows title","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"RegAsm.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","id":"static-144","level":"informative","name":"PE file contains COM data directory","origin":"Static Parser","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"\" (Indicator: \"CreateFile\"; Source: \"00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CreateFile\"; Source: \"00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp\")\n Found reference to API \"IcmpCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"RegAsm.pdb\"","id":"string-7","level":"informative","name":"Contains PDB pathways","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2a","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Contains ability to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed string: \"%WINDIR%\\SysWOW64\\tasklist.exe\" [Source: 00000000-00008020-00000BC0-1557551958]\n Observed string: \"%WINDIR%\\system32\\tasklist.exe\" [Source: 00000000-00008020-00000C46-25001814012]\n Observed string: \"tasklist.exe\" [Source: 00000000-00000752-00000BC0-1557576067]","id":"string-517","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate running processes using Tasklist","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2b","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API typically used for searching a directory for files","origin":"API Call","relevance":5,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003344.00000002.173073.03320000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003344.00000002.173073.03320000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006608.00000000.165120.03330000.00000004.mdmp, 00000000-00006608.00000001.167043.03330000.00000004.mdmp, 00000000-00006608.00000002.168963.03330000.00000004.mdmp\")","id":"string-474","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to access device drivers","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\cmd.exe\" /c copy Ind.m4a Ind.m4a.bat & Ind.m4a.bat\" - (UID: 00000000-00007484)\n \"Solved.com\" called \"CreateProcessW\" with parameter \"%TEMP%\\87966\\RegAsm.exe\" - (UID: 00000000-00006608)","id":"api-129","level":"malicious","mitre_attack_id":"T1055","name":"Creates a process in suspended mode (likely for process injection)","origin":"API Call","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-257","level":"informative","mitre_attack_id":"T1049","name":"Contains ability to enumerate network resources (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-269","level":"informative","mitre_attack_id":"T1564","name":"Contains reference to method used by Windows shell items (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: cac213f52f629a3b514dfbe6f6aed65f.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: Solved.com)","id":"static-79","level":"informative","mitre_attack_id":"T1027.007","name":"Contains ability to dynamically determine API calls","origin":"Static Parser","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007484)\n \"RegAsm.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003344)","id":"api-142","level":"informative","mitre_attack_id":"T1010","name":"Calls an API possibly used to retrieve a handle to the foreground window","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$2c","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006608.00000000.165120.07080000.00000004.mdmp, 00000000-00006608.00000001.167043.07080000.00000004.mdmp, 00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-272","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"$2d","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$2e","id":"target-14","level":"malicious","mitre_attack_id":"T1057","name":"Spawns a lot of processes","origin":"Monitored Target","relevance":8,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"$2f","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; File: \"Kb\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003864-00000C2C-1236867438\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003864-00000C2C-1236868118\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003864-00000C2C-1236868816\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")","id":"string-908","level":"informative","mitre_attack_id":"T1033","name":"Able to query security token membership for user discovery (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$30","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Antivirus vendors marked dropped file \"RegAsm.exe\" as clean (type is \"PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections\")","id":"binary-16","level":"informative","name":"Drops files marked as clean","origin":"Binary File","relevance":10,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 75510000","id":"module-17","level":"informative","mitre_attack_id":"T1069.002","name":"Loads Windows LDAP client module","origin":"Loaded Module","relevance":3,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")","id":"string-126","level":"informative","mitre_attack_id":"T1082","name":"Found system command-related strings","origin":"File/Memory","relevance":7,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-122","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006608.00000001.167043.07080000.00000004.mdmp\")","id":"string-205","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$31","id":"api-104","level":"suspicious","mitre_attack_id":"T1057","name":"Calls an API typically used to enumerate process encountered in a system snapshot","origin":"API Call","relevance":5,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")","id":"string-183","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to check debugger is running (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"176.65.134.10:4449\"","id":"network-1","level":"informative","mitre_attack_id":"T1071","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"General","description":"$32","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"ExitWindowsEx@USER32.DLL at 00000000-00001328-16986-54-004033E9","id":"stream-23","level":"malicious","mitre_attack_id":"T1529","name":"Contains ability to reboot/shutdown the operating system","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-312","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve path in which Windows is installed (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-188","level":"informative","mitre_attack_id":"T1115","name":"Contains ability to access clipboard data (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-439","level":"informative","mitre_attack_id":"T1055.003","name":"Contains ability to modify process memory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$33","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Process \"%WINDIR%\\SysWOW64\\cmd.exe\" with commandline \"cmd /k echo [InternetShortcut] > \"%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\DataDash.url\" & echo URL=\"%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\DataDash.url\" & exit\" (UID: 00000000-00000268)","id":"target-343","level":"informative","mitre_attack_id":"T1059.003","name":"Executes echo command","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"SetSystemPowerState\" (Indicator: \"SetSystemPowerState\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"InitiateSystemShutdownExW\" (Indicator: \"InitiateSystemShutdown\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-189","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to reboot/shutdown the operating system (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Observed unmanaged function \"SearchPath\" in \"RegAsm.exe\"\n Observed unmanaged function \"LoadTypeLibEx\" in \"RegAsm.exe\"\n Observed unmanaged function \"RegisterTypeLib\" in \"RegAsm.exe\"\n Observed unmanaged function \"UnRegisterTypeLib\" in \"RegAsm.exe\"","id":"static-101","level":"informative","mitre_attack_id":"T1106","name":"Found Native API in Dotnet file","origin":"Static Parser","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$34","id":"string-208","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to show a graphical window (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"cac213f52f629a3b514dfbe6f6aed65f.exe\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\"","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Able to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-115","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve data about the local computer (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-426","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to modify file attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"RegAsm.exe\" sets a global windows hook with filter \"WH_KEYBOARD_LL\"","id":"api-71","level":"informative","mitre_attack_id":"T1056.004","name":"Sets a windows hook","origin":"API Call","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"tasklist.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"RegAsm.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","id":"api-264","level":"informative","mitre_attack_id":"T1055.003","name":"Creates a thread in a self process","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$35","id":"string-141","level":"informative","mitre_attack_id":"T1010","name":"Contains ability to retrieve open application windows (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"\"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000752)\n \"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005364)\n \"RegAsm.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003344)","id":"api-111","level":"informative","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Remote Access Related","description":"file/memory contains long string(File: \"RegAsm.exe\")","id":"string-940","level":"informative","mitre_attack_id":"T1021","name":"Able to modify Remote Configuration","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$36","id":"string-64","level":"informative","mitre_attack_id":"T1106","name":"Input file contains API references not part of its Import Address Table (IAT)","origin":"File/Memory","relevance":10,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$37","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Process \"cmd.exe\" with commandline \"/c copy Ind.m4a Ind.m4a.bat & Ind.m4a.bat\" (UID: 00000000-00008020)","id":"target-220","level":"informative","mitre_attack_id":"T1059","name":"Executes batch file","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-537","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a new HTTP request (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$38","id":"api-263","level":"informative","mitre_attack_id":"T1083","name":"Touches files","origin":"API Call","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$39","id":"api-222","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve OS information","origin":"API Call","relevance":2,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003344.00000000.173056.03320000.00000004.mdmp, 00000000-00003344.00000002.173073.03320000.00000004.mdmp\")\n Found reference to API \"PRINT,NS_WRPDllRegister::APIHook_GetProcAddress,189,[ApiName] Hook Entered\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003344.00000002.173073.03320000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cmd.exe\" wrote to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\DataDash.url\"\n \"cmd.exe\" wrote to file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\DataDash.url\"","id":"api-278","level":"informative","mitre_attack_id":"T1547.001","name":"System process creates file in Startup folder","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RegAsm.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00007184)","id":"api-223","level":"suspicious","mitre_attack_id":"T1070.006","name":"Calls an API typically used to query local/system time as file time","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"System Security","description":"$3a","id":"static-87","level":"informative","mitre_attack_id":"T1134.001","name":"Imports system security related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"System Security","description":"\"Solved.com\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","id":"registry-67","level":"informative","mitre_attack_id":"T1543.003","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RegAsm.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\87966\\RegAsm.exe\" at 00000000-00003344-00000C17-1702068974\n \"RegAsm.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll\" at 00000000-00003344-00000C17-1702435103\n \"RegAsm.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Management\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Management.dll\" at 00000000-00003344-00000C17-1703206717\n \"RegAsm.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll\" at 00000000-00003344-00000C17-1741841146\n \"RegAsm.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Accessibility\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Accessibility.dll\" at 00000000-00003344-00000C17-1742535946","id":"api-11","level":"informative","mitre_attack_id":"T1082","name":"Queries volume information","origin":"API Call","relevance":2,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$3b","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for Djb2 Hash Algorithm matched on file \"DataDash.com\"\n YARA signature for Djb2 Hash Algorithm matched on file \"Solved.com\"","id":"yara-542","level":"informative","mitre_attack_id":"T1027","name":"YARA signature match - Djb2 Hash Algorithm","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-538","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to create a HTTP or FTP session (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RegAsm.exe\" (Thread ID: 3432) slept \"525\" times (threshold: 500)","id":"api-47","level":"suspicious","mitre_attack_id":"T1497.003","name":"Possibly tries to evade analysis by sleeping many times","origin":"API Call","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process \"00000000-00003820\"","id":"yara-52","level":"suspicious","mitre_attack_id":"T1497.001","name":"YARA signature match - References common sandbox DLLs (sandbox evasion)","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"OpenProcess@KERNEL32.DLL at 00000000-00001328-16986-47-00405C44","id":"stream-31","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve/open a process","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-107","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host's architecture (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: Solved.com]","id":"static-189","level":"informative","mitre_attack_id":"T1057","name":"Calls an APIs used to retrieve process information","origin":"Static Parser","relevance":5,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-222","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve network parameters of a computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"$3c","id":"memorydump-2","level":"informative","mitre_attack_id":"T1071","name":"Found potential URLs in memory dumps","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: The input sample contains the RDTSCP instruction\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)","id":"summary-29","level":"informative","mitre_attack_id":"T1480","name":"Shows ability to use execution guardrails","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"### 2025-06-01 11:24:00 PM ###www.youtube.com/watch?v=9bZkp7q19f0### 2025-06-01 11:38:06 PM ###www.reddit.com/r/gifs### 2025-06-02 1:38:00 AM ###www.youtube.com/watch?v=9bZkp7q19f0\" (Indicator: \"youtube.com\"; File: \"clipboard_logs.txt\")","id":"string-761","level":"informative","mitre_attack_id":"T1590","name":"Able to access user sensitive domain","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"System Security","description":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006608.00000000.165120.07080000.00000004.mdmp, 00000000-00006608.00000001.167043.07080000.00000004.mdmp, 00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-729","level":"informative","mitre_attack_id":"T1489","name":"Able to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" was detected as \"Nullsoft PiMP Stub -> SFX\"\n \"Solved.com\" was detected as \"VC8 -> Microsoft Corporation\"\n \"RegAsm.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-320","level":"informative","mitre_attack_id":"T1564.003","name":"Contains ability to pass information to a window procedure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"Solved.com wrote PE header bytes (\"4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f74206265\") to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\87966\\RegAsm.exe\"\n which might be an injection preparation attempt ...","id":"api-83","level":"malicious","mitre_attack_id":"T1055.002","name":"Writes PE header to memory","origin":"API Call","relevance":7,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 737A0000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 73480000","id":"module-8","level":"informative","mitre_attack_id":"T1562.001","name":"Loads the AMSI (Antimalware Scan Interface) DLL","origin":"Loaded Module","sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcess\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"115247183042,6592,3142,,CreateProcessW,kernel32.dll,\"00:43:43.125\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006608.00000002.168963.07080000.00000004.mdmp\")","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"%WINDIR%\\SysWOW64\\findstr.exe\" (Source: \"00000000-00008020-00000BC0-1557596043\")\n Found string \"%WINDIR%\\system32\\findstr.exe\" (Source: \"00000000-00008020-00000C46-25103273796\")\n Found string \"findstr /I \"opssvc wrsa\"\" (Source: \"00000000-00008020-00000C46-25103273796\")\n Found string \"findstr \"bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn\"\" (Source: \"00000000-00008020-00000C46-37908593548\")\n Found string \"findstr /V \"float\" Blind\" (Source: \"00000000-00008020-00000C46-53627703138\")","id":"string-688","level":"informative","mitre_attack_id":"T1082","name":"Able to find string content in a file","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed email domain:\"dpmodemx.dll\" [Source: 00000000-00003820.00000001.146676.03920000.00000004.mdmp\n 00000000-00003820.00000002.148598.03920000.00000004.mdmp]\n Observed email domain:\"idimap.dll\" [Source: 00000000-00003820.00000001.146676.03920000.00000004.mdmp\n 00000000-00003820.00000002.148598.03920000.00000004.mdmp]","id":"string-169","level":"informative","mitre_attack_id":"T1071.003","name":"Found mail related domain names","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 715865)","id":"binary-26","level":"informative","mitre_attack_id":"T1497","name":"The input sample contains the RDTSCP instruction","origin":"Binary File","relevance":5,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$3d","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003344.00000002.173073.00932000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-423","level":"informative","mitre_attack_id":"T1074.001","name":"Contains ability to create directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Pattern match: \"t@l.wr\"","id":"string-63","level":"informative","mitre_attack_id":"T1114","name":"Found E-Mail address in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"file/memory contains long string with (Indicator: \"HttpWebRequest\"; File: \"RegAsm.exe\")","id":"string-798","level":"informative","mitre_attack_id":"T1105","name":"Able to download remote files using web shell script","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0100000000\")","id":"registry-136","level":"informative","mitre_attack_id":"T1112","name":"Writes registry keys","origin":"Registry Access","relevance":3,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$3e","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00001328-16986-5-00405B93\n LoadLibraryExW@KERNEL32.DLL at 00000000-00001328-16986-16-0040159C\n LoadLibraryA@KERNEL32.DLL at 00000000-00001328-16986-47-00405C44","id":"stream-108","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to dynamically load libraries","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$3f","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"SystemParametersInfoW@USER32.DLL at 00000000-00001328-16986-60-004053CC","id":"stream-123","level":"suspicious","mitre_attack_id":"T1098","name":"Contains ability to update the user profile","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-210","level":"informative","mitre_attack_id":"T1559","name":"Contains ability to create/connect to a named pipe (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"RegAsm.exe\" set a windows hook with filter \"WH_KEYBOARD_LL\"","id":"api-72","level":"malicious","mitre_attack_id":"T1056.004","name":"Sets a global windows hook to intercept keystrokes","origin":"API Call","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string(File: \"RegAsm.exe\")","id":"string-937","level":"informative","mitre_attack_id":"T1082","name":"Able to gather system information (.NET)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$40","id":"string-193","level":"informative","mitre_attack_id":"T1082","name":"Able to query volume/memory size (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$41","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76C00000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76C00000\n \"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76C00000\n \"findstr.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76C00000\n \"extrac32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76C00000\n \"Solved.com\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76C00000\n \"choice.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76C00000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76C00000","id":"module-10","level":"informative","mitre_attack_id":"T1129","name":"Loads the RPC (Remote Procedure Call) module DLL","origin":"Loaded Module","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$42","id":"api-22","level":"informative","mitre_attack_id":"T1574.002","name":"Fails to load modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$43","id":"registry-72","level":"informative","mitre_attack_id":"T1546.015","name":"Overview of unique CLSIDs touched in registry","origin":"Registry Access","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00001328)\n \"extrac32.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00004948)","id":"api-144","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to open an existing named mutex object","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetTypeLibGuidForAssembly\" in \"RegAsm.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GenerateGuidForType\" in \"RegAsm.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"PtrToStructure\" in \"RegAsm.exe\"","id":"static-107","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to load content into memory (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"System Security","description":"$44","id":"registry-173","level":"informative","mitre_attack_id":"T1007","name":"Queries services related registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$45","id":"binary-92","level":"informative","mitre_attack_id":"T1027.005","name":"XOR operations in executable file detected","origin":"Binary File","sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Dropped file: \"S\" - Location: [%LOCALAPPDATA%\\DataDive Technologies\\S]- [targetUID: 00000000-00006608]\n Dropped file: \"Finder-Latest.log\" - Location: [%APPDATA%\\Finder-Latest.log]- [targetUID: 00000000-00003344]\n Dropped file: \"DataDash.js\" - Location: [%LOCALAPPDATA%\\DataDive Technologies\\DataDash.js]- [targetUID: 00000000-00006608]\n Dropped file: \"clipboard_logs.txt\" - Location: [%LOCALAPPDATA%\\b8755439bbaef8499326d21b38ff3487\\logs\\clipboard\\2025-06-01\\clipboard_logs.txt]- [targetUID: 00000000-00003344]\n Dropped file: \"DataDash.url\" - Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\DataDash.url]- [targetUID: 00000000-00000268]\n Dropped file: \"DataDash.com\" - Location: [%LOCALAPPDATA%\\DataDive Technologies\\DataDash.com]- [targetUID: 00000000-00006608]","id":"binary-37","level":"informative","mitre_attack_id":"T1036","name":"Drops files inside appdata directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"tasklist.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Solved.com\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Solved.com\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"Found registry deletion API: \"RegDeleteKeyExW\" in file \"cac213f52f629a3b514dfbe6f6aed65f.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"cac213f52f629a3b514dfbe6f6aed65f.exe\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"cac213f52f629a3b514dfbe6f6aed65f.exe\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\"","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Able to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"S has high entropy\"\n \"Baking.m4a has high entropy\"\n \"Assess.m4a has high entropy\"\n \"Rid.m4a has high entropy\"\n \"Catch.m4a has high entropy\"\n \"Tires.m4a has high entropy\"\n \"Licenses.m4a has high entropy\"\n \"Organisations.m4a has high entropy\"\n \"Lens.m4a has high entropy\"\n \"Mysterious.m4a has high entropy\"\n \"Motor.m4a has high entropy\"\n \"Motel.m4a has high entropy\"\n \"Worldcat.m4a has high entropy\"\n \"Cannon.m4a has high entropy\"\n \"Latinas.m4a has high entropy\"\n \"Cole.m4a has high entropy\"\n \"Above.m4a has high entropy\"\n \"Parameter.m4a has high entropy\"\n \"Blocking.m4a has high entropy\"\n \"Michael.m4a has high entropy\"\n \"Ir.m4a has high entropy\"\n \"Curves.m4a has high entropy\"\n \"Karma.m4a has high entropy\"\n \"Cherry.m4a has high entropy\"\n \"Ages.m4a has high entropy\"","id":"binary-90","level":"informative","mitre_attack_id":"T1027.013","name":"Drops file with high entropy, indicating encryption/obfuscation","origin":"Binary File","relevance":3,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00000752)\n \"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00005364)","id":"api-147","level":"informative","mitre_attack_id":"T1614","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" called \"GetActiveWindow\" (UID: 00000000-00001328)","id":"api-150","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to get handle of currently active window","origin":"API Call","relevance":5,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"Solved.com\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"RegAsm.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","id":"api-108","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve information about the current system","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-248","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine timezone (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00003864)\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" with parameter %TEMP%\\ (UID: 00000000-00003864)\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" with parameter C:\\Users (UID: 00000000-00003864)\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003864)\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00003864)\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00003864)\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00003864)\n \"Solved.com\" with parameter %LOCALAPPDATA%\\DataDive Technologies (UID: 00000000-00003820)","id":"api-318","level":"informative","mitre_attack_id":"T1074.001","name":"Creates directory on disk","origin":"API Call","relevance":3,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00003820.00000001.146676.03920000.00000004.mdmp, 00000000-00003820.00000002.148598.03920000.00000004.mdmp\")\n Found string \"pstorec.dll\" (Indicator: \"pstorec.dll\"; Source: \"00000000-00003820.00000001.146676.03920000.00000004.mdmp, 00000000-00003820.00000002.148598.03920000.00000004.mdmp\")","id":"string-5","level":"suspicious","mitre_attack_id":"T1518.001","name":"Possibly checks for known debuggers/analysis tools","origin":"File/Memory","relevance":2,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$46","id":"api-205","level":"informative","mitre_attack_id":"T1070.006","name":"Calls an API typically used to set the date and time of the file","origin":"API Call","relevance":2,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$47","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemMetrics@USER32.DLL at 00000000-00001328-16986-83-00404B88","id":"stream-122","level":"suspicious","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"General","description":"$48","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\blocking.m4a\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\mysterious.m4a\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\cannon.m4a\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\damn.m4a\"","id":"api-242","level":"informative","name":"Writes files","origin":"API Call","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"RegAsm.exe\" called \"GetComputerNameW\" (UID: 00000000-00003344)","id":"api-141","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve computer name","origin":"API Call","relevance":2,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 72AF0000","id":"module-16","level":"informative","mitre_attack_id":"T1518.001","name":"Loads the debugger/analysis tool module","origin":"Loaded Module","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" called \"ShellExecuteW\" with parameter %WINDIR%\\system32\\cmd (UID: 00000000-00007484)","id":"api-117","level":"malicious","mitre_attack_id":"T1106","name":"Calls an API typically used to execute an application","origin":"API Call","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00007484)\n \"Solved.com\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00006608)","id":"api-294","level":"informative","mitre_attack_id":"T1082","name":"Attempts to call APIs to gather system and hardware detail","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Process \"cmd.exe\" with commandline \"/c copy Ind.m4a Ind.m4a.bat & Ind.m4a.bat\" (UID: 00000000-00008020)\n Process \"cmd.exe\" with commandline \"cmd /c copy /b ..\\\\Howard.m4a + ..\\\\Cannon.m4a + ..\\\\Cherry.m4a + ..\\\\Limit.m4a + ..\\\\Motor.m4a + ..\\\\Assess.m4a + ..\\\\Tires.m4a + ..\\\\Above.m4a + ..\\\\Baking.m4a + ..\\\\Rid.m4a + ..\\\\Blocking.m4a + ..\\\\Landing.m4a + ..\\\\Temple.m4a + ..\\\\Damn.m4a + ..\\\\Mysterious.m4a + ..\\\\Michael.m4a + ..\\\\Curves.m4a + ..\\\\Worldcat.m4a + ..\\\\Karma.m4a + ..\\\\Shuttle.m4a + ..\\\\Pay.m4a + ..\\\\Messages.m4a + ..\\\\Amount.m4a + ..\\\\Five.m4a + ..\\\\Motel.m4a + ..\\\\Latinas.m4a + ..\\\\Messenger.m4a + ..\\\\Lens.m4a + ..\\\\Hydrocodone.m4a + ..\\\\Organisations.m4a + ..\\\\Cole.m4a + ..\\\\Ipaq.m4a + ..\\\\Licenses.m4a + ..\\\\Catch.m4a + ..\\\\Garage.m4a + ..\\\\Knit.m4a + ..\\\\Ages.m4a + ..\\\\Parameter.m4a + ..\\\\Ir.m4a + ..\\\\Puzzle.m4a n\" (UID: 00000000-00000208)","id":"target-291","level":"informative","mitre_attack_id":"T1570","name":"Tries to copy files","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-82","level":"informative","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Solved.com\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"RegAsm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1082","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")","id":"string-901","level":"informative","mitre_attack_id":"T1124","name":"Able to retrieve date formats supported by the local system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" called \"GetAsyncKeyState\" with parameters {\"vKey\": \"27\"}","id":"api-40","level":"suspicious","mitre_attack_id":"T1056.001","name":"Calls an API typically used for keylogging","origin":"API Call","relevance":10,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$49","id":"registry-177","level":"informative","mitre_attack_id":"T1012","name":"Opens registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-162","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve volume information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","id":"registry-55","level":"informative","mitre_attack_id":"T1518","name":"Reads the registry for installed applications","origin":"Registry Access","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" queries basic process information of the \"C:\\cac213f52f629a3b514dfbe6f6aed65f.exe\" (UID: 7484)","id":"api-235","level":"informative","mitre_attack_id":"T1057","name":"Queries basic information of the specified process","origin":"API Call","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Solved.com\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Solved.com\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"RegAsm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"RegAsm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$4a","id":"string-88","level":"informative","mitre_attack_id":"T1056.001","name":"Able to retrieve information about pressed keystrokes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found strings \"ctfmon.exe,update.exe,rundll32.exe,svchost.exe,wininit.exe\" (Source: \"00000000-00003820.00000001.146676.03920000.00000004.mdmp\")","id":"string-455","level":"informative","mitre_attack_id":"T1569.002","name":"Contains reference to multiple windows system processes","origin":"File/Memory","relevance":3,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" connecting to \"\\ThemeApiPort\"\n \"extrac32.exe\" connecting to \"\\ThemeApiPort\"\n \"Solved.com\" connecting to \"\\ThemeApiPort\"","id":"api-16","level":"informative","mitre_attack_id":"T1559","name":"Connects to LPC ports","origin":"API Call","relevance":1,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"General","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72C40000","id":"module-2","level":"informative","mitre_attack_id":"T1129","name":"Loads rich edit control libraries","origin":"Loaded Module","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$4b","id":"api-55","level":"informative","mitre_attack_id":"T1083","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"External Systems","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","id":"suricata-0","level":"informative","name":"Detected Suricata Alert","origin":"Suricata Alerts","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"RC2\"; File: \"Messages.m4a\")\n Found reference to \"(GlobalSign Timestamping CA - SHA384 - G40\" (Indicator: \"SHA384\"; Source: \"00000000-00006608.00000000.165120.07080000.00000004.mdmp, 00000000-00006608.00000001.167043.07080000.00000004.mdmp, 00000000-00006608.00000002.168963.07080000.00000004.mdmp\")\n Found reference to \"(GlobalSign Timestamping CA - SHA384 - G4\" (Indicator: \"SHA384\"; Source: \"00000000-00006608.00000000.165120.07080000.00000004.mdmp, 00000000-00006608.00000001.167043.07080000.00000004.mdmp, 00000000-00006608.00000002.168963.07080000.00000004.mdmp\")","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-478","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve process ID (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"Solved.com\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\87966\\Solved.com]- [targetUID: 00000000-00006608]\n \"RegAsm.exe\" has type \"PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%TEMP%\\87966\\RegAsm.exe]- [targetUID: 00000000-00006608]","id":"binary-33","level":"informative","mitre_attack_id":"T1105","name":"Drops executable files inside temp directory","origin":"Binary File","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"Solved.com\" claimed CRC 1010675 while the actual is CRC 3681306\n \"RegAsm.exe\" claimed CRC 70812 while the actual is CRC 1010675","id":"static-0","level":"suspicious","mitre_attack_id":"T1027","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"https://user-images.githubusercontent.com/45857590/138568746-1a5578fe-f51b-4114-bcf2-e374535f848\" (Indicator: \"githubusercontent.com\"; Source: \"00000000-00003344-00000CB8-1707384015\")","id":"string-186","level":"informative","mitre_attack_id":"T1102","name":"Found domain strings related to cloud services(possible C&C communication)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"General","description":"Found string \"### 2025-06-01 11:24:00 PM ###www.youtube.com/watch?v=9bZkp7q19f0### 2025-06-01 11:38:06 PM ###www.reddit.com/r/gifs### 2025-06-02 1:38:00 AM ###www.youtube.com/watch?v=9bZkp7q19f0\" (Indicator: \"youtube\"; File: \"clipboard_logs.txt\")","id":"string-10","level":"informative","name":"Found a reference to a known community page","origin":"File/Memory","relevance":2,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00000752)\n Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00005364)","id":"target-136","level":"malicious","mitre_attack_id":"T1057","name":"Tries to gather information about running processes on a system","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"file/memory contains long string with (Indicator: \"WNetAddConnection\"; File: \"Kb\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"WNetAddConnection\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")\n Found reference to API \"WNetUseConnectionW\" (Indicator: \"WNetUseConnection\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")\n Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")","id":"string-923","level":"informative","mitre_attack_id":"T1135","name":"Able to access Windows networking-related API (String)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Process \"findstr.exe\" with commandline \"findstr /I \"opssvc wrsa\"\" (UID: 00000000-00003088)\n Process \"findstr.exe\" with commandline \"findstr \"bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn\"\" (UID: 00000000-00000724)\n Process \"findstr.exe\" with commandline \"findstr /V \"float\" Blind\" (UID: 00000000-00006740)","id":"target-244","level":"informative","mitre_attack_id":"T1083","name":"Searches for patterns in files","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found PE header \"MZ\" - Source: \"00000000-00006608.00000002.168963.07080000.00000004.mdmp\")","id":"memorydump-8","level":"informative","mitre_attack_id":"T1055","name":"Found PE header in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"category":"General","description":"$4c","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")","id":"string-309","level":"informative","mitre_attack_id":"T1055.003","name":"Able to modify thread functionality – possible hijack (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found GetCursorPos() in an import section (Source: Solved.com)","id":"static-132","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect sandbox (imports API)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"FindNextFileW@KERNEL32.DLL at 00000000-00001328-16986-16-0040159C\n FindFirstFileW@KERNEL32.DLL at 00000000-00001328-16986-24-00405B6C\n FindFirstFileW@KERNEL32.DLL at 00000000-00001328-16986-38-0040652D","id":"stream-89","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files inside a directory","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-547","level":"informative","mitre_attack_id":"T1562.001","name":"Contains ability to block user input (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")","id":"string-439","level":"informative","mitre_attack_id":"T1055.003","name":"Able to modify process memory (API string)","origin":"File/Memory","sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007484)","id":"api-297","level":"informative","mitre_attack_id":"T1003","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: Solved.com]","id":"static-88","level":"informative","mitre_attack_id":"T1106","name":"Imports GetCommandLine API","origin":"Static Parser","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$4d","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Able to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"tracert.exe\" (Indicator: \"tracert\"; Source: \"00000000-00003820.00000001.146676.03920000.00000004.mdmp, 00000000-00003820.00000002.148598.03920000.00000004.mdmp\")","id":"string-430","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve system network configuration","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7484:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:7484:64:WilError_01\"\n \"Local\\SM0:7484:64:WilError_01\"\n \"Local\\SM0:7484:168:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:7484:64:WilError_01\"\n \"\\BaseNamedObjects\\SyncRootManager\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7484:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:752:168:WilStaging_02\"\n \"SM0:752:168:WilStaging_02\"","id":"mutant-0","level":"informative","mitre_attack_id":"T1480","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"External Systems","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_60% (W)","id":"avtest-9","level":"suspicious","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","origin":"External System","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"Solved.com\" called \"IsWow64Process\" with parameter \"6608\" - (UID: 00000000-00006608)\n \"RegAsm.exe\" called \"IsWow64Process\" with parameter \"3344\" - (UID: 00000000-00003344)","id":"api-146","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used to determine if process is running under WOW64","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$4e","id":"target-67","level":"informative","mitre_attack_id":"T1057","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00001328-16986-78-00403FDF","id":"stream-37","level":"informative","mitre_attack_id":"T1497.001","name":"Contains ability to query volume size","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"General","description":"Sleep@KERNEL32.DLL at 00000000-00001328-16986-16-0040159C\n SetTimer at 00000000-00001328-16986-49-00402DB4","id":"stream-103","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay the execution of current thread","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-239","level":"informative","mitre_attack_id":"T1548.002","name":"Contains ability to bypass UAC using COM object (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-80","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to determine disk drive type (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"Solved.com\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)\n \"Solved.com\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)","id":"registry-202","level":"informative","mitre_attack_id":"T1082","name":"Reads system mouse configuration","origin":"Registry Access","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-437","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to retrieve token privileges information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"$4f","id":"string-601","level":"informative","mitre_attack_id":"T1071","name":"Contains ability to communicate with network (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Destruction","description":"file/memory contains long string(File: \"Kb\")\n Found string \"SHEmptyRecycleBinW\" (Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")","id":"string-922","level":"informative","mitre_attack_id":"T1070","name":"Able to permanently delete files from the Recycle Bin","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetTickCount@KERNEL32.DLL at 00000000-00001328-16986-29-00405901\n GetTickCount@KERNEL32.DLL at 00000000-00001328-16986-31-00402EE7\n GetTickCount@KERNEL32.DLL at 00000000-00001328-16986-50-004030EF\n GetTickCount@KERNEL32.DLL at 00000000-00001328-16986-51-00402E3A","id":"stream-87","level":"informative","mitre_attack_id":"T1497","name":"Contains ability to detect virtual environment (API)","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" has section name .text with entropy \"6.421737576039348\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" has section name .rsrc with entropy \"7.9282609764821945\"\n \"Solved.com\" has section name .text with entropy \"6.673713166877414\"\n \"Solved.com\" has section name .reloc with entropy \"6.761662253540421\"","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.009","name":"Section contains high entropy","origin":"Static Parser","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-131","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-314","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve internet settings (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76F80000\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72EA0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76F80000\n \"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76F80000\n \"tasklist.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72EA0000\n \"findstr.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76F80000\n \"extrac32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76F80000\n \"Solved.com\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76F80000\n \"choice.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76F80000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76F80000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72EA0000","id":"module-9","level":"informative","mitre_attack_id":"T1027","name":"Loads the Bcrypt module DLL","origin":"Loaded Module","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetVersion@KERNEL32.DLL at 00000000-00001328-16986-12-0040609E\n GetVersionExW@KERNEL32.DLL at 00000000-00001328-16986-47-00405C44","id":"stream-3","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to query the machine version","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cmd.exe\" wrote 22 bytes to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\DataDash.url\": 5b496e7465726e657453686f72746375745d20200d0a\n \"cmd.exe\" wrote 74 bytes to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\DataDash.url\": 55524c3d22433a5c55736572735c687a336231374d5c417070446174615c4c6f63616c5c446174614469766520546563686e6f6c6f676965735c44617461446173682e6a732220200d0a\n \"cmd.exe\" wrote to file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\DataDash.url\"","id":"api-90","level":"informative","mitre_attack_id":"T1547.001","name":"Writes a file to the startup folder","origin":"API Call","relevance":10,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"c:\\users\\%osuser%\\documents\\desktop.ini\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"c:\\users\\%osuser%\\music\\desktop.ini\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"c:\\users\\%osuser%\\pictures\\desktop.ini\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"c:\\users\\%osuser%\\videos\\desktop.ini\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"c:\\users\\%osuser%\\downloads\\desktop.ini\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"c:\\users\\%osuser%\\onedrive\\desktop.ini\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"c:\\cac213f52f629a3b514dfbe6f6aed65f.exe\"","id":"api-243","level":"informative","mitre_attack_id":"T1083","name":"Reads files","origin":"API Call","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$50","id":"registry-215","level":"informative","mitre_attack_id":"T1497","name":"Observed a high volume of repeated registry API calls (API Hammering)","origin":"Registry Access","relevance":1,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$51","id":"static-1","level":"suspicious","mitre_attack_id":"T1106","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$52","id":"string-721","level":"informative","mitre_attack_id":"T1055.015","name":"Able to visualize and control listed components (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"External Systems","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","id":"avtest-5","level":"malicious","mitre_attack_id":"T1204.002","name":"Sample was identified as malicious by a trusted antivirus engine","origin":"External System","relevance":10,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$53","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"GetExecutingAssembly\"; File: \"RegAsm.exe\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00003344.00000002.173073.00932000.00000002.mdmp\")","id":"string-615","level":"informative","mitre_attack_id":"T1620","name":"Can load assembly that contains the code that is currently executing (Dotnet)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$54","id":"string-170","level":"informative","name":"Possibly uses system binaries (Windows LOLbins)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Observed function \"System.Reflection.ReflectionOnlyLoadFrom\" in \"RegAsm.exe\"\n Observed function \"System.Reflection.UnsafeLoadFrom\" in \"RegAsm.exe\"\n Observed function \"System.Reflection.get_LoaderExceptions\" in \"RegAsm.exe\"\n Observed function \"System.Reflection.ReflectionOnlyLoad\" in \"RegAsm.exe\"","id":"static-115","level":"informative","mitre_attack_id":"T1620","name":"Dotnet code contains potential unpacker","origin":"Static Parser","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"General","description":"\"Solved.com\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"RegAsm.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Network Related","description":"Observed import api \"WNetAddConnection\" which can \"make a connection to a network resource\" [Source: Solved.com]\n Observed import api \"WNetCancelConnection\" which can \"cancel an existing network connection\" [Source: Solved.com]\n Observed import api \"WNetGetConnection\" which can \"retrieve the name of the network resource associated with a local device\" [Source: Solved.com]\n Observed import api \"WNetUseConnection\" which can \"make a connection to a network resource\" [Source: Solved.com]","id":"static-86","level":"informative","mitre_attack_id":"T1135","name":"Imports windows networking-related APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RegAsm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007484)","id":"api-296","level":"informative","mitre_attack_id":"T1497","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"General","description":"\"TvoIIdkJjszTbBl.TvoIIdkJjszTbBl\"","id":"network-51","level":"informative","mitre_attack_id":"T1071.004","name":"Queries DNS server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"tasklist.exe\" at 00000000-00003260-00000105-1767745\n \"tasklist.exe\" at 00000000-00003744-00000105-1100332","id":"api-10","level":"informative","mitre_attack_id":"T1622","name":"Queries kernel debugger information","origin":"API Call","relevance":6,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"General","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Solved.com\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"RegAsm.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$55","id":"api-139","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to load a resource in memory","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Raw size of \".ndata\" is zero","id":"static-5","level":"informative","mitre_attack_id":"T1027","name":"PE file contains zero-sized sections","origin":"Static Parser","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"General","description":"The input sample is signed with a certificate issued by \"CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3\" (SHA1: 4C:5D:80:D2:CD:06:B1:A4:93:C4:9B:2E:9B:ED:4A:57:C2:F8:73:E5; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Code Signing Root R45, O=GlobalSign nv-sa, C=BE\" (SHA1: C1:0B:B7:6A:D4:EE:81:52:42:40:6A:1E:3E:11:17:FF:EC:74:3D:4F; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE\" (SHA1: F7:A5:24:AD:45:E5:85:F8:B7:1E:62:04:B2:58:37:14:15:1A:08:EF; see report for more information)","id":"certificate-0","level":"informative","mitre_attack_id":"T1553.002","name":"The input sample is signed with a certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")","id":"string-168","level":"informative","mitre_attack_id":"T1134.002","name":"Contains ability to create process with token (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WNetUseConnectionW\" (Indicator: \"WNetUseConnection\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")","id":"string-113","level":"informative","mitre_attack_id":"T1135","name":"Contains ability to provide information and utilities for managing network resources (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"findstr /I \"opssvc wrsa\"\" (Indicator: \"findstr \"; Source: \"00000000-00008020-00000C46-25103273796\")\n Found string \"findstr \"bdservicehost SophosHealth AvastUI AVGUI nsWscSvc ekrn\"\" (Indicator: \"findstr \"; Source: \"00000000-00008020-00000C46-37908593548\")\n Found string \"findstr /V \"float\" Blind\" (Indicator: \"findstr \"; Source: \"00000000-00008020-00000C46-53627703138\")","id":"string-334","level":"informative","mitre_attack_id":"T1552","name":"Contains ability to search for patterns of text (possibly credentials) in files","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"RegAsm.exe\" called \"GetUserNameW\" (UID: 00000000-00003344)","id":"api-135","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve user name","origin":"API Call","relevance":2,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-220","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create/control drivers (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"2614082404,6592,113,,SystemParametersInfoW,user32.dll,\"00:42:56.187\",RX=0,PX=0\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006608.00000000.165120.03330000.00000004.mdmp, 00000000-00006608.00000001.167043.03330000.00000004.mdmp, 00000000-00006608.00000002.168963.03330000.00000004.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-132","level":"informative","mitre_attack_id":"T1098","name":"Contains ability to modify the user configuration/privilege (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cmd.exe\" allocated memory in \"%WINDIR%\\system32\\cmd.exe\"","id":"api-20","level":"suspicious","mitre_attack_id":"T1055","name":"Allocates virtual memory in a remote process","origin":"API Call","relevance":7,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"cmd.exe\" obfuscates its traffic by mimicking legitimate API call","id":"api-289","level":"informative","mitre_attack_id":"T1497","name":"Triggers a burst of requests to the same API (API Hammering)","origin":"API Call","relevance":1,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")","id":"string-419","level":"informative","mitre_attack_id":"T1571","name":"Contains ability to open a port and listen for incoming connection (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"General","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 71980000","id":"module-7","level":"informative","mitre_attack_id":"T1620","name":"Loads the CLR Loader DLL","origin":"Loaded Module","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$56","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Contains ability to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-403","level":"informative","mitre_attack_id":"T1056","name":"Contains ability to register/read input devices (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00003820.00000000.144752.01760000.00000002.mdmp, 00000000-00003820.00000001.146676.01760000.00000002.mdmp, 00000000-00003820.00000002.148598.01760000.00000002.mdmp\")","id":"string-899","level":"informative","mitre_attack_id":"T1071","name":"Contains references to network communication API (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Sample file \"sample.bin\" has high entropy 7.9985696870718375","id":"binary-71","level":"informative","mitre_attack_id":"T1027","name":"Sample file has high entropy (likely encrypted/compressed content)","origin":"Binary File","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$57","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" has an writable section named \".data\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" has an writable section named \".ndata\"\n \"Solved.com\" has an writable section named \".data\"","id":"static-95","level":"informative","name":"PE file contains writable sections","origin":"Static Parser","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","id":"registry-13","level":"informative","mitre_attack_id":"T1082","name":"Reads the windows installation date","origin":"Registry Access","relevance":3,"sources":[{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")","id":"string-532","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host name of a computer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Network Related","description":"Contacted domain: \"TvoIIdkJjszTbBl.TvoIIdkJjszTbBl\" has high entropy","id":"network-81","level":"informative","mitre_attack_id":"T1568.002","name":"High entropy domain detected","origin":"Network Traffic","relevance":5,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for RSA public and private key matched on file \"RegAsm.exe\"","id":"yara-62","level":"suspicious","mitre_attack_id":"T1027","name":"YARA signature match - RSA algorithm (keys)","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Calls an API typically used to decrypt data\n Matched sigs: Reads the cryptographic machine GUID","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"AddressOfEntryPoint\"; Source: \"00000000-00006608.00000002.168963.071F1000.00000004.mdmp\")","id":"string-311","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-143","level":"informative","mitre_attack_id":"T1614.001","name":"Contains ability to retrieve system language (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\tasklist.exe\" (Handle: 472)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\findstr.exe\" (Handle: 468)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\tasklist.exe\" (Handle: 420)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\findstr.exe\" (Handle: 472)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\extrac32.exe\" (Handle: 472)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\findstr.exe\" (Handle: 432)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\87966\\Solved.com\" (Handle: 124)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\choice.exe\" (Handle: 420)","id":"api-0","level":"malicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Observed function \"get_OSVersion\" in \"RegAsm.exe\"","id":"static-120","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to gather system information (Dotnet)","origin":"Static Parser","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-539","level":"informative","mitre_attack_id":"T1071.001","name":"Contains reference to Windows internet services (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-553","level":"informative","mitre_attack_id":"T1070","name":"Contains ability to modify file system redirection (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"cac213f52f629a3b514dfbe6f6aed65f.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","id":"api-6","level":"suspicious","mitre_attack_id":"T1083","name":"Reads configuration files (.ini files)","origin":"API Call","relevance":4,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"cmd.exe\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\87966\\n\"","id":"api-4","level":"informative","mitre_attack_id":"T1074.001","name":"Creates a writable file in a temporary directory","origin":"API Call","relevance":1,"sources":[{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$58","id":"string-625","level":"informative","mitre_attack_id":"T1083","name":"References Windows file paths for DLLs (possible dropped files)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")","id":"string-417","level":"informative","mitre_attack_id":"T1018","name":"Able to identify remote systems","origin":"File/Memory","relevance":7,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: cac213f52f629a3b514dfbe6f6aed65f.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Solved.com]","id":"static-191","level":"informative","mitre_attack_id":"T1489","name":"Calls an API used to open a process handle","origin":"Static Parser","relevance":5,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Network Related","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","id":"summary-27","level":"informative","mitre_attack_id":"T1119","name":"Shows ability to send encrypted data to the internet","origin":"Indicator Combinations","relevance":2,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"General","description":"$59","id":"string-307","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to create/load registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"General","description":"$5a","id":"string-322","level":"informative","mitre_attack_id":"T1570","name":"Contains ability to move file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"tasklist.exe\" issued a query \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\"\n \"RegAsm.exe\" issued a query \"SELECT * FROM Win32_Processor\"\n \"RegAsm.exe\" issued a query \"$objects\"\n \"RegAsm.exe\" issued a query \"SELECT * FROM Win32_VideoController\"","id":"api-56","level":"informative","mitre_attack_id":"T1047","name":"Executes WMI queries","origin":"API Call","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-450","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to determine if process is running under WOW64 (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"$5b","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","id":"registry-27","level":"suspicious","mitre_attack_id":"T1090.001","name":"Modifies proxy settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-225","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate another user on the local machine (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"cac213f52f629a3b514dfbe6f6aed65f.exe\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\"","id":"string-307","level":"informative","mitre_attack_id":"T1112","name":"Able to create/load registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string(File: \"Kb\")\n Found string \"GetClipboardData\" (Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")","id":"string-915","level":"informative","mitre_attack_id":"T1115","name":"Able to capture drag-drop file operations","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"Solved.com\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\87966\\n\" with delete access","id":"api-25","level":"suspicious","mitre_attack_id":"T1070.004","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$5c","id":"api-122","level":"informative","mitre_attack_id":"T1074.001","name":"Calls an API typically used to create a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00008020)","id":"api-138","level":"informative","mitre_attack_id":"T1570","name":"Calls an API typically used to create an instance of a named pipe","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$5d","id":"string-88","level":"informative","mitre_attack_id":"T1056.001","name":"Contains ability to retrieve information about pressed keystrokes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"Solved.com\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"690109cd\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"Solved.com\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"690109cd\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","id":"api-105","level":"informative","mitre_attack_id":"T1113","name":"Calls an API possibly used to take screenshots","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"tasklist.exe\" called \"LookupAccountSidW\" with param Name hz3b17M (UID: 00000000-00003260)\n \"tasklist.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003260)\n \"tasklist.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003260)\n \"tasklist.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003744)\n \"tasklist.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003744)","id":"api-148","level":"informative","mitre_attack_id":"T1033","name":"Calls an API typically used to retrieve account information for specified SID","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-111","level":"informative","mitre_attack_id":"T1070","name":"Contains ability to empty the recycle bin (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"Solved.com\" called \"CreateProcessW\" with parameter \"%TEMP%\\87966\\RegAsm.exe\" - (UID: 00000000-00006608)","id":"api-134","level":"malicious","mitre_attack_id":"T1055.012","name":"Creates a system process in suspended mode (likely for process injection)","origin":"API Call","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"\"RegAsm.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","id":"static-154","level":"informative","name":"File contains dynamic base/NX flags","origin":"Static Parser","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"External Systems","description":"10/26 Antivirus vendors marked sample as malicious (38% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"\n \"extrac32.exe\" opened \"\\Device\\KsecDD\"\n \"Solved.com\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"Ind.m4a.bat\" has type \"ASCII text with very long lines (4973) with CRLF line terminators\"- Location: [%TEMP%\\Ind.m4a.bat]- [targetUID: 00000000-00002796]","id":"binary-41","level":"informative","mitre_attack_id":"T1105","name":"Drops Windows batch files","origin":"Binary File","relevance":3,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$5e","id":"binary-60","level":"suspicious","mitre_attack_id":"T1027","name":"Dropped file has high entropy (likely encrypted/compressed content)","origin":"Binary File","relevance":5,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-550","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to find and load resources of specific modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"Solved.com\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","id":"registry-174","level":"informative","mitre_attack_id":"T1652","name":"Tries to retrieve device driver information","origin":"Registry Access","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"Kb\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\")","id":"string-884","level":"informative","mitre_attack_id":"T1083","name":"Able to rename or move file/directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-97","level":"informative","mitre_attack_id":"T1548","name":"Contains ability to use security policy setting (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"\"tasklist.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"\\RPC Control\\OLE35E78942A62E4C04BEE3D83C759E\"\n \"tasklist.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"\\RPC Control\\OLE7A87F48BB4D144E6A269F5A11E5C\"","id":"api-28","level":"informative","mitre_attack_id":"T1134","name":"Adjusts debug privileges","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","id":"registry-179","level":"informative","mitre_attack_id":"T1562.001","name":"Tries to map intranet network resources to internet zone","origin":"Registry Access","relevance":1,"sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 176.65.134.10 on port 4449","id":"network-7","level":"malicious","mitre_attack_id":"T1571","name":"Uses network protocols on unusual ports","origin":"Network Traffic","relevance":7,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-534","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to read files (API string)","origin":"File/Memory","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006608.00000001.167043.07080000.00000004.mdmp\")","id":"string-212","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to perform decryption (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"RegAsm.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Finder-Latest.log\"\n \"RegAsm.exe\" writes a file \"%APPDATA%\\Finder-Latest.log\"","id":"api-159","level":"informative","mitre_attack_id":"T1074.001","name":"Writes log files","origin":"API Call","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"RegAsm.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003344)","id":"api-152","level":"informative","mitre_attack_id":"T1010","name":"Calls an API typically used to enumerate active windows","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"Solved.com\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%TEMP%\\87966\\Solved.com]- [targetUID: 00000000-00006608]\n \"RegAsm.exe\" has type \"PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%TEMP%\\87966\\RegAsm.exe]- [targetUID: 00000000-00006608]\n \"DataDash.com\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 5 sections\"- Location: [%LOCALAPPDATA%\\DataDive Technologies\\DataDash.com]- [targetUID: 00000000-00006608]","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"cmd.exe\" wrote 2 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\87966\\Solved.com\": 4d5a ...\n \"Solved.com\" wrote 29784 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\DataDive Technologies\\DataDash.com\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"Solved.com\" wrote 64704 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\87966\\RegAsm.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","id":"api-43","level":"suspicious","mitre_attack_id":"T1105","name":"Writes a PE file header to disc","origin":"API Call","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$5f","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found registry query API: \"RegEnumKeyW\" in file \"cac213f52f629a3b514dfbe6f6aed65f.exe\"\n Found registry query API: \"RegOpenKeyExW\" in file \"cac213f52f629a3b514dfbe6f6aed65f.exe\"\n Found registry query API: \"RegEnumValueW\" in file \"cac213f52f629a3b514dfbe6f6aed65f.exe\"\n Found registry query API: \"RegQueryValueExW\" in file \"cac213f52f629a3b514dfbe6f6aed65f.exe\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00003820.00000000.144752.00E1D000.00000002.mdmp\"","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Able to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")","id":"string-228","level":"informative","mitre_attack_id":"T1095","name":"Contains ability to communicate with C2 using Sockets (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"System Security","description":"Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00006608.00000002.168963.00A0D000.00000002.mdmp","id":"string-406","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to shutdown system","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$60","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-241","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to download a file from a URL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Network Related","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-453","level":"informative","mitre_attack_id":"T1071.001","name":"Contains ability to set options for internet handles (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"General","description":"$61","id":"string-265","level":"informative","mitre_attack_id":"T1547.001","name":"Contains reference to Windows Startup folder","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Network Related","description":"\"4.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\"\n Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\"\n \"176.65.134.10\"\n \"0.0.0.0\"\n \"255.255.255.255\"\n \"6.0.9.0\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Assembly shows XOR instruction xor esi\n ecx in Stream UID: 00000000-00001328-16986-16-0040159C\n Assembly shows XOR instruction xor ecx\n 00180000h in Stream UID: 00000000-00001328-16986-36-00405721\n Assembly shows XOR instruction xor bp\n bx in Stream UID: 00000000-00001328-16986-63-004039D0\n Assembly shows XOR instruction xor ecx\n 00000080h in Stream UID: 00000000-00001328-16986-82-00404451\n Assembly shows XOR instruction xor ecx\n 01h in Stream UID: 00000000-00001328-16986-82-00404451","id":"stream-139","level":"informative","mitre_attack_id":"T1027.005","name":"Contains XOR operation loops [Stream disassembly]","origin":"Hybrid Analysis Technology","sources":[{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"}]},{"category":"General","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70000000","id":"module-3","level":"informative","mitre_attack_id":"T1129","name":"Loads the .NET runtime environment","origin":"Loaded Module","sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$62","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"RegAsm.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3344)","id":"api-1","level":"suspicious","mitre_attack_id":"T1562.001","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Ransomware/Banking","description":"Observed import api \"SHEmptyRecycleBin\" which can \"empty the Recycle Bin on the specified drive\" [Source: Solved.com]","id":"static-84","level":"informative","mitre_attack_id":"T1070","name":"Imports SHEmptyRecycleBin API","origin":"Static Parser","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$63","id":"string-304","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to modify registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"System Security","description":"$64","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"cac213f52f629a3b514dfbe6f6aed65f.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00006608.00000002.168963.00A0D000.00000002.mdmp\")","id":"string-193","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to query volume/memory size (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"683cac72742e955ef80403cc","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"cac213f52f629a3b514dfbe6f6aed65f.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nscE788.tmp\" for deletion\n \"Solved.com\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\87966\\n\" for deletion","id":"api-26","level":"suspicious","mitre_attack_id":"T1070.004","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"683cac6d0fc0c3b3fd030e37","report_type":"sandbox"},{"report_id":"683cac7e0c80f88e3a004694","report_type":"sandbox"},{"report_id":"683cac7829d589f4cc05b986","report_type":"sandbox"},{"report_id":"699f17b924002f0eb60300d2","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":10,"suspicious_count":0,"total_engines":26},"mitre_attacks":{"total":103},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":285,"malicious_count":11,"suspicious_count":25,"total":321}},"summary":{"score":100,"tags":["evasive","windows-server-utility"],"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"cac213f52f629a3b514dfbe6f6aed65f.exe","file_size":3627016,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"bf95d1fc1d10de18b32654b123ad5e1f","md5":"cac213f52f629a3b514dfbe6f6aed65f","sha1":"086d159e34b5d87af4108a9be6444be824ac5de4","sha256":"899ce99aa7fda10c1b37b29f2353d3fd9f91e4119292bd437ab6a8c5066cafa0","sha512":"f515e3bcad0c5aae3c79d8ec106692d3fc09ec891a4ebfc8f752f17273f762dd467b1517e4cdb4159b6e3f5c77ce11017c5ca764f6e635e6e44fa38e205be231","ssdeep":"98304:tCx5wDbXHymZzzibfR/SPrJMNNIrDF9wod5Ggl3NtT:tawDLyIzzIfR/hN6VSMogl/T","ssdeep_chunks":["98304:tCx5wDb","98304:Cx5wDbX","98304:x5wDbXH","98304:5wDbXHy","98304:wDbXHym","98304:DbXHymZ","98304:bXHymZz","98304:XHymZzz","98304:HymZzzi","98304:ymZzzib","98304:mZzzibf","98304:ZzzibfR","98304:zzibfR/","98304:zibfR/S","98304:ibfR/SP","98304:bfR/SPr","98304:fR/SPrJ","98304:R/SPrJM","98304:/SPrJMN","98304:SPrJMNN","98304:PrJMNNI","98304:rJMNNIr","98304:JMNNIrD","98304:MNNIrDF","98304:NNIrDF9","98304:NIrDF9w","98304:IrDF9wo","98304:rDF9wod","98304:DF9wod5","98304:F9wod5G","98304:9wod5Gg","98304:wod5Ggl","98304:od5Ggl3","98304:d5Ggl3N","98304:5Ggl3Nt","98304:Ggl3NtT","196608:tCx5wDb","196608:Cx5wDbX","196608:x5wDbXH","196608:5wDbXHy","196608:wDbXHym","196608:DbXHymZ","196608:bXHymZz","196608:XHymZzz","196608:HymZzzi","196608:ymZzzib","196608:mZzzibf","196608:ZzzibfR","196608:zzibfR/","196608:zibfR/S","196608:ibfR/SP","196608:bfR/SPr","196608:fR/SPrJ","196608:R/SPrJM","196608:/SPrJMN","196608:SPrJMNN","196608:PrJMNNI","196608:rJMNNIr","196608:JMNNIrD","196608:MNNIrDF","196608:NNIrDF9","196608:NIrDF9w","196608:IrDF9wo","196608:rDF9wod","196608:DF9wod5","196608:F9wod5G","196608:9wod5Gg","196608:wod5Ggl","196608:od5Ggl3","196608:d5Ggl3N","196608:5Ggl3Nt","196608:Ggl3NtT","98304:tawDLyI","98304:awDLyIz","98304:wDLyIzz","98304:DLyIzzI","98304:LyIzzIf","98304:yIzzIfR","98304:IzzIfR/","98304:zzIfR/h","98304:zIfR/hN","98304:IfR/hN6","98304:fR/hN6V","98304:R/hN6VS","98304:/hN6VSM","98304:hN6VSMo","98304:N6VSMog","98304:6VSMogl","98304:VSMogl/","98304:SMogl/T"]},"submissions":{"first_seen":1748592648000,"last_multi_scan":1772033978000,"last_seen":1772033978000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["683cac7e0c80f88e3a004694","683cac7829d589f4cc05b986","683cac72742e955ef80403cc","683cac6d0fc0c3b3fd030e37","699f17b924002f0eb60300d2"]},"schema_version":"1.0.9","sha256":"899ce99aa7fda10c1b37b29f2353d3fd9f91e4119292bd437ab6a8c5066cafa0","threat_score":100,"unified_at":"2026-09-16T18:31:38.734Z","unified_at_epoch_ms":1789583498734,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 899ce99aa7fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 899ce99aa7fd…. Malware family: Trojan.Generic. Threat score 100/100. 10/26 AV engines flagged this file. 11 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/899ce99aa7fda10c1b37b29f2353d3fd9f91e4119292bd437ab6a8c5066cafa0"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 899ce99aa7fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 899ce99aa7fd…. Malware family: Trojan.Generic. Threat score 100/100. 10/26 AV engines flagged this file. 11 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/899ce99aa7fda10c1b37b29f2353d3fd9f91e4119292bd437ab6a8c5066cafa0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 899ce99aa7fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 899ce99aa7fd…. Malware family: Trojan.Generic. Threat score 100/100. 10/26 AV engines flagged this file. 11 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L65","11",{}]]