21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 59:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4a8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.ClipBanker Sample 8a964d8fb524… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8a964d8fb524…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 18/27 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","keywords":["Malicious","IL:Trojan.ClipBanker","malware analysis","sandbox report","threat intelligence","8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.ClipBanker","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T565,Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp")23:T64d,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp")24:T7fe,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp")25:Tb88,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\TREATAS") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\TREATAS") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\PROGID") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\PROGID") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCHANDLER32") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCHANDLER32") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCHANDLER") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCHANDLER") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\OBJECTS\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}")26:T428,Assembly shows XOR instruction xor esi dword ptr [edx] in Stream UID: 00000000-00002160-62438-4-001C29A1 Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00002160-62438-4-001C29A1 Assembly shows XOR instruction xor eax 00003200h in Stream UID: 00000000-00002160-62438-4-001C29A1 Assembly shows XOR instruction xor dword ptr [esi] ebp in Stream UID: 00000000-00002160-62438-4-001C29A1 Assembly shows XOR instruction xor byte ptr [esi] ch in Stream UID: 00000000-00002160-62438-4-001C29A1 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00002160-62438-4-001C29A1 Assembly shows XOR instruction xor dword ptr [ecx] edi in Stream UID: 00000000-00002160-62438-4-001C29A1 Assembly shows XOR instruction xor byte ptr [ebp+64h] ah in Stream UID: 00000000-00002160-62438-4-001C29A1 Assembly shows XOR instruction xor bh byte ptr [ecx] in Stream UID: 00000000-00002160-62438-4-001C29A1 Assembly shows XOR instruction xor dh byte ptr [edx+424E54B5h] in Stream UID: 00000000-00003496-63008-2-00402EB827:T4dc,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains reference to cryptographic keys Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]28:Taf74,Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 69941; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 161332; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 178315; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 192382; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 287389; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 306758; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 396167; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 422126; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 443560; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 444430; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 476661; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 517523; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 537262; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 619021; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 660895; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 677320; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 690033; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 734322; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 766685; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 783286; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 786598; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 836750; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 837554; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1010434; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1016403; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1097068; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1108426; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1141519; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1148361; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1164515; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1175737; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1186018; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1190738; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1378763; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1387795; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1569337; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1689703; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1739231; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1764819; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1896241; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1941233; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1942971; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1994584; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2007987; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2041675; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2075419; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2256214; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2405562; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2461405; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2469997; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2646588; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2676709; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2860829; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3000046; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3009367; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3187892; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3324067; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3362975; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3427732; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3443030; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3462042; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3561452; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3596769; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3832638; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3890752; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3922570; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4013866; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4072493; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4187281; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 115100; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 205509; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 212218; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 299717; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 309751; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 332256; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 478080; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 490786; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 490963; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 551906; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 643169; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 680672; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 764170; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 774662; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 794489; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 812154; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 893112; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 898410; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 960041; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 962074; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1056695; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1098265; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1282060; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1325905; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1349504; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1365298; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1375143; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1485654; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1757860; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1793777; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1871956; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1934607; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1942609; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1965091; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1976270; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1988505; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2221255; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2617241; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2634277; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2653706; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2719113; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2933420; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2962569; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3031176; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3158624; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3407394; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3641257; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3689560; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3734470; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3819817; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3832157; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3873086; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3920156; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4031863; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4095984; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4126584; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4207312; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 144527; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 192439; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 193652; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 213508; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 223084; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 223418; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 275772; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 308059; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 318513; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 372369; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 524279; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 530333; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 531121; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 751531; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 790299; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 796509; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 999765; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1138238; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1187409; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1191331; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1267606; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1272214; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1316873; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1480583; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1823651; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1905666; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1939021; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1950266; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1979743; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1984028; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2083917; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2153179; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2156154; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2229549; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2299625; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2326372; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2330384; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2523598; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2565213; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2587919; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2730952; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2800769; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2827426; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2865947; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2904603; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2915952; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2961205; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2998257; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3143551; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3189817; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3262541; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3476496; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3643487; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3690893; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3703177; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3707703; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3758728; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3797109; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3821714; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3846291; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3847270; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3851241; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3866723; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3869462; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3887427; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3929184; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4069968; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4216813; code bytes = 8030 Found XOR loop in file "toolspub2.exe" at offset 132333; code bytes = 30d0 Found XOR loop in file "toolspub2.exe" at offset 81948; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 91971; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 99146; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 216459; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 223803; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 309814; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 317671; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 337700; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 500152; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 511665; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 568634; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 686736; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 985924; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 992519; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1048792; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1109691; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1142614; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1156108; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1165580; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1323364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1326145; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1399215; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1487255; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1589456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1694933; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1792767; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1818371; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1931855; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1962379; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1983538; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2015671; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2021583; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2081204; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2102759; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2153468; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2296796; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2304982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2309870; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2336828; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2367732; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2424542; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2472185; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2484052; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2562099; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2620176; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2642089; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2727035; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2812373; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3069314; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3088260; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3179786; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3197551; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3272826; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3302309; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3324031; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3334753; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3351021; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3430211; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3453034; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3530395; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3539443; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3694172; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3719631; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3738359; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3739447; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3796436; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3923359; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3929296; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3989364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4016982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4118969; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4198393; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4796388; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4843908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5096292; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5257508; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6229028; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6814756; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6823556; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6825703; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6897828; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6962596; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7438500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7444132; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7489650; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7885892; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7922148; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8039364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8138276; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8177183; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8617266; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9353798; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9421009; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10087179; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10088733; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10267580; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 88086; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 166607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 202010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 330154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 405303; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 492705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 496594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 519435; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 556631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 610584; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 663005; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 678166; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 691474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 718459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 724312; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 947365; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 947774; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1026736; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1210371; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1234935; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1255399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1397942; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1413382; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1472798; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1542615; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1607842; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1753725; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1784945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1856734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1936703; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2004706; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2090349; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2203216; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2323705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2369771; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2509275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2510863; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2516482; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2693552; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2811733; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2829904; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2923361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2944885; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2961365; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2978127; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3115659; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3138368; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3213314; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3254791; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3299314; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3301200; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3308466; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3330112; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3351186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3354950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3394805; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3440369; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3471667; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3540823; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3551297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3559115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3561636; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3630105; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3694538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3845383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4056568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4111333; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4206669; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4780114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4854738; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4855635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4872690; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4873746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4874450; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4987442; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5038730; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5061258; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5088254; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5472958; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5537374; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5553516; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5587006; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5604908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5689036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5765531; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5769403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5782718; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5823259; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5828154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5852364; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5862150; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5895660; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5941947; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5976403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6003020; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6003084; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6024492; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6144385; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6279052; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6386046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6450604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6497292; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6500044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6567570; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6570738; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6573906; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6575859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6577074; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6579186; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6590860; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7176588; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7178060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7375870; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7377982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7382860; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7574170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7575346; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7575386; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7584090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7720492; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7745555; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7759852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7779262; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7798924; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7803916; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8830047; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8840579; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9371746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9439460; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9450372; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9759891; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9992299; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10064826; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10072275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10075701; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10083831; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10084467; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10098037; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10107745; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10230860; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10233784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10240650; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10272835; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1082911; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 3623595; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 218430; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 231527; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 273797; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 335964; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 367763; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 412414; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 530017; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 650611; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 713732; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 747646; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 775888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 786122; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 789678; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 883605; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 974788; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 992961; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1086806; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1284403; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1284669; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1407473; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1515575; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1630273; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1663366; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1706954; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1850898; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1856489; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1896809; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1938688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1954903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2252559; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2421634; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2434006; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2436281; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2524667; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2608676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2613267; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2635362; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2635786; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2642396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2927164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3161385; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3283066; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3304512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3347744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3377959; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3547424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3558357; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3592122; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3728591; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3829041; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3830830; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3865930; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3888003; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3963683; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3992024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3994052; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4011985; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4101641; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4144397; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4184591; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4287180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4362490; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4490418; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4562171; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4573941; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4767867; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4797479; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4838041; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4978244; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5040841; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5055573; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5165814; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5253213; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5588124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6150905; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6185749; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6278873; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6553739; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6558379; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6978119; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7053876; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7075773; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7090205; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7210459; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7309072; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7467197; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7486262; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7524009; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7558365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7751881; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7852117; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7877629; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7919497; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8090735; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8180278; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8180660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8471075; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8833064; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9378278; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9567376; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9981971; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10015904; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10133504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10133636; code bytes = 803029:T43e,file/memory contains long string with (Indicator: "GetCommandLine"; File: "toolspub2.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001292-00000C2C-201049202") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp")2a:T493,Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp")2b:T48a,Found system information discovery API: "GetUserObjectInformationW" in file "00000000-00001292.00000000.76234.00401000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStrings" in file "00000000-00001292.00000000.76234.00401000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in file "00000000-00001292.00000000.76234.00401000.00000020.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00001292.00000000.76234.00401000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00001292.00000000.76234.00401000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001292.00000000.76234.00401000.00000020.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00001372.00000000.75725.034F0000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00001372.00000000.75725.034F0000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001372.00000000.75725.034F0000.00000004.mdmp"2c:T80e,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000270132a00256f004a0000000000000000000000008000000000000000256f004ac0762f000100000000000000020000000c000000582f2f00582f2f00532f2f00000000000000000000002a0000000001c0ee190000000000e0f4190095e13777a5666900feffffff435c3b7750593b7794000000a0000000522f2f00502f2f009400000064f01900fdfea47644e9190001000000e0f4190092e01372ddcde56afefffffffcef19004c9c13725c0c000010f019005f9c13720000000000000000 (UID: 00000000-00001372)2d:Te3b,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c005300f0fa2d00110000111a51000030922f0070132a00b1080000aaa8640000200000b0080000580f00000d004200a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff5c00500000000000b1080000 (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eba27528c234000070fd7f9a5c3c7700b0fd7f84c0ac044470fd7f00000000400000003f000000210000000070fd7f78c0ac04c15c3c7760824377210000000070fd7f9a5c3c7700b0fd7f9cc0ac0457893b778083437713174975d8eba275 (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001372) "toolspub2.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001292) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000b4ea1200000000000000000000000000c8ea1200000000000000000000000000ddb1d86ebcea1200186d4875bcea12002a6d48751c5c3a7743794875ffffffff0c0000004c623a771f794875ffffffff0c000000d0ea1200040000000004000001000000e4ea1200210e290200000000 (UID: 00000000-00000600) "kos4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310064353061336122202f3e0d0a2020202020202020202020203c73656374696f6e206e616d653d226865616c74684d6f6e69746f72696e672220747970653d2253797374656d2e5765622e436f6e66696775726174696f6e2e4865616c74684d6f6e69746f72696e6753656374696f6e2c20 (UID: 00000000-00002160) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000b4ea1200000000000000000000000000c8ea120000000000000000000000000000bb4a6ebcea1200186d4875bcea12002a6d48751c5c3a7743794875ffffffff0c0000004c623a771f794875ffffffff0c000000d0ea1200040000000004000001000000e4ea1200210e4e0200000000 (UID: 00000000-00003468)2e:T72e,Found reference to API "FindNextVolumeMountPointA" (Indicator: "FindNextVolume"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointA" (Indicator: "FindNextVolumeMountPoint"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolume"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolumeMountPoint"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointA" (Indicator: "FindNextVolume"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointA" (Indicator: "FindNextVolumeMountPoint"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolume"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolumeMountPoint"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointA" (Indicator: "FindNextVolume"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "FindNextVolumeMountPointA" (Indicator: "FindNextVolumeMountPoint"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolume"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolumeMountPoint"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp")2f:T718,"kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "kos4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")30:T4e6,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\KOS4.EXE") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\KOS4.EXE") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LATESTX.EXE") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LATESTX.EXE") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\31839B57A4F11171D6ABC8BBC4451EE4.EXE") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\31839B57A4F11171D6ABC8BBC4451EE4.EXE") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\TOOLSPUB2.EXE") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\TOOLSPUB2.EXE")31:T559,"kos4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "kos4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "kos4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")32:T53ea,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter 8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00001372) "toolspub2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001292) "toolspub2.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00001292) "toolspub2.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00001292) "toolspub2.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001292) "toolspub2.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001292) "toolspub2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001292) "toolspub2.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001292) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00000600) "kos4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002160) "kos4.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00002160) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003468)33:T14d56,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001372) "toolspub2.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001292) "toolspub2.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001292) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WinStationQueryInformationW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NetUserGetInfo (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter QueryServiceStatusEx (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LsaAddAccountRights (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateProcessWithTokenW (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalA (UID: 00000000-00000600) "kos4.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter TraceRegisterExA (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter TracePrintfExA (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter OpenSCManagerA (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeA (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SslLookupCipherLengths (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetSignatureInterface (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SslDecrementProviderReferenceCount (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00002160) "kos4.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00002160) "toolspub2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003496) "toolspub2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003496) "toolspub2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003496) "toolspub2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003496) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WinStationQueryInformationW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter QueryServiceStatusEx (UID: 00000000-00003468)34:T1243c,Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "DebugActiveProcess"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GlobalFix"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetDefaultCommConfigA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FindFirstFileW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FindFirstChangeNotificationW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetLocaleInfoA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteConsoleInputW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleExA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleAliasExesA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "AllocConsole"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "IsBadHugeReadPtr"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetProcessIoCounters"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteConsoleOutputCharacterA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "MapUserPhysicalPages"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleAliasA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "ZombifyActCtx"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteConsoleInputA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "AddConsoleAliasW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetNumaAvailableMemoryNode"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "OpenSemaphoreA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "MoveFileWithProgressA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GenerateConsoleCtrlEvent"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FindNextVolumeMountPointA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleAliasesA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "ReadConsoleW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WaitNamedPipeW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetCommState"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GlobalAlloc"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "AddRefActCtx"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CopyFileW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateEventA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "TransactNamedPipe"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetTimeZoneInformation"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCompressedFileSizeA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "lstrcatA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FindNextVolumeMountPointW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "ReplaceFileA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetTempPathW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetNamedPipeHandleStateW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "ReadConsoleOutputCharacterA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateConsoleScreenBuffer"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateNamedPipeA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "EnumSystemCodePagesW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetStdHandle"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "VerLanguageNameW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "OpenWaitableTimerA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "AddAtomW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FoldStringW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FindNextFileW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtect"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CompareStringA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetFileTime"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetProcessShutdownParameters"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FindAtomW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetVolumeNameForVolumeMountPointW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "DeleteFileW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "ResetWriteWatch"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTime"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "lstrcpyW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CharUpperW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WinHttpReadData"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "MoveFileA"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapReAlloc"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "EncodePointer"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "DecodePointer"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetHandleCount"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetFileType"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteFile"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapCreate"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapFree"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsAlloc"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsGetValue"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsSetValue"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsFree"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetFilePointer"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleCP"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleMode"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "RtlUnwind"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCPInfo"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetACP"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetOEMCP"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "IsValidCodePage"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteConsoleW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapSize"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStringTypeW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "WTSQuerySessionInformationW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "SysAllocStringLen"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "QueryServiceStatusEx"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "LsaAddAccountRights"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "VariantInit"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "VariantClear"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "SysStringLen"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "NetUserGetInfo"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "LsaOpenPolicy"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "LsaClose"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessWithTokenW"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassExA"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000000.76234.00401000.00000020.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000000.76234.00401000.00000020.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtectEx"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000000.76234.00401000.00000020.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "WinExec"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "DebugActiveProcess"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GlobalFix"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetDefaultCommConfigA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FindFirstChangeNotificationW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetLocaleInfoA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteConsoleInputW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleExA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleAliasExesA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "AllocConsole"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "IsBadHugeReadPtr"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetProcessIoCounters"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteConsoleOutputCharacterA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "MapUserPhysicalPages"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleAliasA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "ZombifyActCtx"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteConsoleInputA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "AddConsoleAliasW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetNumaAvailableMemoryNode"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "OpenSemaphoreA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "MoveFileWithProgressA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GenerateConsoleCtrlEvent"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FindNextVolumeMountPointA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleAliasesA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WaitNamedPipeW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetCommState"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "AddRefActCtx"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "TransactNamedPipe"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetTimeZoneInformation"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCompressedFileSizeA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FindNextVolumeMountPointW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "ReplaceFileA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetNamedPipeHandleStateW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "ReadConsoleOutputCharacterA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateConsoleScreenBuffer"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateNamedPipeA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "EnumSystemCodePagesW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "VerLanguageNameW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "OpenWaitableTimerA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "AddAtomW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FoldStringW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetProcessShutdownParameters"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FindAtomW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetVolumeNameForVolumeMountPointW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "ResetWriteWatch"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WinHttpReadData"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "MoveFileA"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "DebugActiveProcess"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GlobalFix"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "SetDefaultCommConfigA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "FindFirstChangeNotificationW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "SetLocaleInfoA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleInputW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleAliasExesA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "AllocConsole"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "IsBadHugeReadPtr"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessIoCounters"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleOutputCharacterA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "MapUserPhysicalPages"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleAliasA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "ZombifyActCtx"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleInputA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "AddConsoleAliasW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetNumaAvailableMemoryNode"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "OpenSemaphoreA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "MoveFileWithProgressA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GenerateConsoleCtrlEvent"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "FindNextVolumeMountPointA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleAliasesA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "WaitNamedPipeW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "SetCommState"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "AddRefActCtx"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "TransactNamedPipe"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "SetTimeZoneInformation"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetCompressedFileSizeA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "FindNextVolumeMountPointW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "ReplaceFileA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetNamedPipeHandleStateW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "ReadConsoleOutputCharacterA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "CreateConsoleScreenBuffer"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "CreateNamedPipeA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "EnumSystemCodePagesW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "VerLanguageNameW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "OpenWaitableTimerA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "AddAtomW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "FoldStringW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "SetProcessShutdownParameters"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "FindAtomW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetVolumeNameForVolumeMountPointW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "ResetWriteWatch"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "WinHttpReadData"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "MoveFileA"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp, 00000000-00001372.00000001.76242.024F0000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp, 00000000-00001372.00000001.76242.024F0000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00001372.00000001.76242.024F0000.00000004.mdmp") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "00000000-00001372.00000001.76242.024F0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00001372.00000001.76242.024F0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00002160.00000001.78275.001C2000.00000020.mdmp") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "00000000-00002160.00000001.78275.001C2000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002160.00000001.78275.001C2000.00000020.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00002160.00000001.78275.001C2000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002160.00000001.78275.001C2000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "WTSQuerySessionInformationW"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "SysAllocStringLen"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "QueryServiceStatusEx"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "VariantInit"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "VariantClear"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "SysStringLen"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp")35:T450,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001372.00000001.76242.002A0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001372.00000001.76242.002A0000.00000004.mdmp 00000000-00001372.00000001.76242.00840000.00000002.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001372.00000001.76242.002A0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001372.00000001.76242.002A0000.00000004.mdmp 00000000-00001372.00000001.76242.00840000.00000002.mdmp36:Td1c,"S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00000600.00000001.77164.0B400000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00000600.00000001.77164.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00000600.00000001.77164.0B400000.00000004.mdmp "HKEY_USERS\" in Source: 00000000-00000600.00000001.77164.0B400000.00000004.mdmp "092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00000600.00000001.77164.0B400000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00000600.00000001.77164.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00000600.00000001.77164.0B400000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001372.00000000.75725.002A0000.00000004.mdmp 00000000-00001372.00000001.76242.002A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001372.00000000.75725.002A0000.00000004.mdmp 00000000-00001372.00000001.76242.002A0000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001372.00000001.76242.002A0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001372.00000001.76242.024F0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001372.00000001.76242.024F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001372.00000001.76242.024F0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "HKEY_USERS\" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "483f7b2ab61d68d9c611c15cd59bcab01ee7084508c9bcdc2dce238def72cd67483f7b2ab61d68d9c611c15cd59bcab01ee7084508c9bcdc2dce238def72cd67HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "HKEY_USERS\1464" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp37:T10ae,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "kos4.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135]38:Te0d,"S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00000600.00000001.77164.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00000600.00000001.77164.0B400000.00000004.mdmp "HKEY_USERS\" in Source: 00000000-00000600.00000001.77164.0B400000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00000600.00000001.77164.0B400000.00000004.mdmp "092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00000600.00000001.77164.0B400000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00000600.00000001.77164.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00000600.00000001.77164.0B400000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001372.00000000.75725.002A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001372.00000000.75725.002A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001372.00000001.76242.002A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001372.00000001.76242.002A0000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001372.00000001.76242.002A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001372.00000001.76242.024F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001372.00000001.76242.024F0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001372.00000001.76242.024F0000.00000004.mdmp "700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "HKEY_USERS\" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "483f7b2ab61d68d9c611c15cd59bcab01ee7084508c9bcdc2dce238def72cd67483f7b2ab61d68d9c611c15cd59bcab01ee7084508c9bcdc2dce238def72cd67HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "HKEY_USERS\1464" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00003468.00000001.77659.0B800000.00000004.mdmp39:T3737,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 720a0000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70c70000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "KERNEL32" at base 76a00000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "ADVAPI32.DLL" at base 77500000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b8c0000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "SHLWAPI.DLL" at base 755a0000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "VERSION.DLL" at base 74700000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64310000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "USER32.DLL" at base 77290000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "MSCOREE.DLL" at base 6b950000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "PSAPI.DLL" at base 75940000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "RPCRT4.DLL" at base 76ed0000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "KERNEL32.DLL" at base 76a00000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 62f00000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "OLE32.DLL" at base 76be0000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "CRYPTBASE.DLL" at base 75160000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73d70000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72180000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 624a0000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61c80000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d20000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "SHELL32.DLL" at base 75db0000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "PROPSYS.DLL" at base 73e40000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "COMCTL32.DLL" at base 74160000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "OLEAUT32.DLL" at base 76ae0000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "CLBCATQ.DLL" at base 75d20000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73e40000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "NTMARTA.DLL" at base 746d0000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 774d0000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "PROFAPI.DLL" at base 75270000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "APPHELP.DLL" at base 75110000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6f4f0000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75db0000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 754d0000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 757f0000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76a00000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "SETUPAPI.DLL" at base 75600000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "SECUR32.DLL" at base 74f90000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75470000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71730000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75110000 "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6af80000 "toolspub2.exe" loaded module "KERNEL32.DLL" at base 76a00000 "toolspub2.exe" loaded module "MSIMG32.DLL" at base 73d60000 "toolspub2.exe" loaded module "USER32" at base 77290000 "toolspub2.exe" loaded module "KERNEL32" at base 76a00000 "toolspub2.exe" loaded module "NTDLL.DLL" at base 77360000 "toolspub2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d20000 "toolspub2.exe" loaded module "DWMAPI.DLL" at base 73d90000 "toolspub2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75110000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "KERNEL32.DLL" at base 76a00000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSIMG32.DLL" at base 73d60000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSVCR100.DLL" at base 6aec0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "ADVAPI32.DLL" at base 77500000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "NTDLL.DLL" at base 77360000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WINMM.DLL" at base 6f710000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WS2_32.DLL" at base 76df0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "CRYPTBASE.DLL" at base 75160000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76a00000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "POWRPROF.DLL" at base 74090000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WTSAPI32.DLL" at base 737b0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WINSTA.DLL" at base 751d0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 774d0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "RPCRT4.DLL" at base 76ed0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "OLE32.DLL" at base 76be0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "CLBCATQ.DLL" at base 75d20000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "CRYPTSP.DLL" at base 74c70000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74a00000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "RPCRTREMOTE.DLL" at base 75200000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d20000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 721d0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77500000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6d7c0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76ae0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "SXS.DLL" at base 75170000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "OLEAUT32.DLL" at base 76ae0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6ce50000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6e0c0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6dcb0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 72190000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "NETAPI32.DLL" at base 73940000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "SAMLIB.DLL" at base 74070000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 721a0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 72160000 "kos4.exe" loaded module "VERSION.DLL" at base 74700000 "kos4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70c70000 "kos4.exe" loaded module "KERNEL32" at base 76a00000 "kos4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64310000 "kos4.exe" loaded module "USER32.DLL" at base 77290000 "kos4.exe" loaded module "MSCOREE.DLL" at base 6b950000 "kos4.exe" loaded module "PSAPI.DLL" at base 75940000 "kos4.exe" loaded module "RPCRT4.DLL" at base 76ed0000 "kos4.exe" loaded module "KERNEL32.DLL" at base 76a00000 "kos4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 62f00000 "kos4.exe" loaded module "OLE32.DLL" at base 76be0000 "kos4.exe" loaded module "CRYPTBASE.DLL" at base 75160000 "kos4.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 731c0000 "kos4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6b830000 "kos4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 61a40000 "kos4.exe" loaded module "ADVAPI32.DLL" at base 77500000 "kos4.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72a00000 "kos4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 626e0000 "kos4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6af80000 "kos4.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 612c0000 "kos4.exe" loaded module "NTDLL.DLL" at base 77360000 "kos4.exe" loaded module "SHELL32.DLL" at base 75db0000 "kos4.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 774d0000 "kos4.exe" loaded module "PROFAPI.DLL" at base 75270000 "kos4.exe" loaded module "BCRYPT.DLL" at base 74d80000 "kos4.exe" loaded module "CRYPTSP.DLL" at base 74c70000 "kos4.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74a00000 "kos4.exe" loaded module "RASAPI32.DLL" at base 6bb40000 "kos4.exe" loaded module "RTUTILS.DLL" at base 73070000 "kos4.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 774d0000 "kos4.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 774d0000 "kos4.exe" loaded module "WS2_32.DLL" at base 76df0000 "kos4.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74c30000 "kos4.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74790000 "kos4.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74c20000 "kos4.exe" loaded module "RASMAN.DLL" at base 6d6a0000 "kos4.exe" loaded module "WINHTTP.DLL" at base 70eb0000 "kos4.exe" loaded module "SHLWAPI.DLL" at base 755a0000 "kos4.exe" loaded module "SSPICLI.DLL" at base 750f0000 "kos4.exe" loaded module "CREDSSP.DLL" at base 74930000 "kos4.exe" loaded module "IPHLPAPI.DLL" at base 735c0000 "kos4.exe" loaded module "DHCPCSVC6.DLL" at base 734d0000 "kos4.exe" loaded module "DHCPCSVC.DLL" at base 73460000 "kos4.exe" loaded module "NSI.DLL" at base 774c0000 "kos4.exe" loaded module "CFGMGR32.DLL" at base 75290000 "kos4.exe" loaded module "OLEAUT32.DLL" at base 76ae0000 "kos4.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 774d0000 "kos4.exe" loaded module "DNSAPI.DLL" at base 74af0000 "kos4.exe" loaded module "RASADHLP.DLL" at base 719c0000 "kos4.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 734f0000 "kos4.exe" loaded module "SECUR32.DLL" at base 74f90000 "kos4.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74a70000 "kos4.exe" loaded module "NCRYPT.DLL" at base 74da0000 "kos4.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74940000 "kos4.exe" loaded module "CRYPT32.DLL" at base 75340000 "kos4.exe" loaded module "USERENV.DLL" at base 752e0000 "kos4.exe" loaded module "GPAPI.DLL" at base 74840000 "toolspub2.exe" loaded module "ADVAPI32" at base 77500000 "toolspub2.exe" loaded module "SHELL32" at base 75db0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 720a0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSIMG32.DLL" at base 72fe0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSVCR100.DLL" at base 69070000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 71ed0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 6af400003a:Ta99,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WBEM Scripting Locator" (Path: "HKCU\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "PSDispatch" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020420-0000-0000-C000-000000000046}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "PSEnumVariant" (Path: "HKCU\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS")3b:Tdcd,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "31839b57a4f11171d6abc8bbc4451ee4.exe" file has an entrypoint instructions - "call 0x40896b,jmp 0x405398,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],xor ecx, ecx,cmp eax, dword ptr [ecx*8 + 0x80c010],je 0x405535,inc ecx,cmp ecx, 0x2d,jb 0x405519,lea ecx, [eax - 0x13],cmp ecx, 0x11,ja 0x40553e,push 0xd,pop eax,pop ebp,ret ,mov eax, dword ptr [ecx*8 + 0x80c014],pop ebp,ret ,add eax, 0xffffff44,push 0xe,pop ecx,cmp ecx, eax,sbb eax, eax,and eax, ecx,add eax, 8,pop ebp,ret ,call 0x40862e,test eax, eax,jne 0x405560,mov eax, 0x80c178,ret ,add eax, 8,ret ,call 0x40862e," "toolspub2.exe" file has an entrypoint instructions - "call 0x40896b,jmp 0x405398,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],xor ecx, ecx,cmp eax, dword ptr [ecx*8 + 0x426010],je 0x405535,inc ecx,cmp ecx, 0x2d,jb 0x405519,lea ecx, [eax - 0x13],cmp ecx, 0x11,ja 0x40553e,push 0xd,pop eax,pop ebp,ret ,mov eax, dword ptr [ecx*8 + 0x426014],pop ebp,ret ,add eax, 0xffffff44,push 0xe,pop ecx,cmp ecx, eax,sbb eax, eax,and eax, ecx,add eax, 8,pop ebp,ret ,call 0x40862e,test eax, eax,jne 0x405560,mov eax, 0x426178,ret ,add eax, 8,ret ,call 0x40862e," "kos4.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3c:T5a6,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "kos4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "kos4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "kos4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")3d:Tf40,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001372-00000C2B-190957764] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001372-00000C2B-191297093] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001372-00000C2B-192472086] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001372-00000C2B-192608358] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001372-00000C2B-192869072] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001372-00000C2B-192939584] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001372-00000C2B-193139246] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001372-00000C2B-193417492] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001372-00000C2B-193491393] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001372-00000C2B-193930545] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001372-00000C2B-193994319] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00001372-00000C2B-194058172] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001372-00000C2B-194145567] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001372-00000C2B-194518418] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00001372-00000C2B-200285545] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" [Source: 00000000-00001372-00000C2B-202250488] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00000600-00000C2B-206880444] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002160-00000C2B-203737925] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00002160-00000C2B-203952284] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00002160-00000C2B-204029243] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00002160-00000C2B-204532403] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002160-00000C2B-205157059] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" [Source: 00000000-00002160-00000C2B-205928195] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00002160-00000C2B-206303486] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" [Source: 00000000-00002160-00000C2B-207004130]3e:Td2d,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "")3f:T1253,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "MAXIMIZEAPPS"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "MAXIMIZEAPPS"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: "SUPPRESSIONPOLICY"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}"; Key: "SUPPRESSIONPOLICY"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32"; Key: "LOADWITHOUTCOM"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE"; Key: "CLSID"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32"; Key: ""; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32"; Key: "LOADWITHOUTCOM"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "ATTRIBUTES"; Value: "")40:T741,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "c:\users\%osuser%\appdata\local\temp\toolspub2.exe" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "c:\users\%osuser%\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exe" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "c:\users\%osuser%\appdata\local\temp\kos4.exe" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "c:\windows\microsoft.net\assembly\gac_msil\system\v4.0_4.0.0.0__b77a5c561934e089\system.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "c:\8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" "toolspub2.exe" reads file "c:\users\%osuser%\appdata\local\temp\toolspub2.exe" "31839b57a4f11171d6abc8bbc4451ee4.exe" reads file "c:\windows\system32\wbem\wbemdisp.tlb"41:T469,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Contains a Wine emulator-related string Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify virtual/sandbox environment Matched sigs: Able to identify virtual/sandbox environment devices Matched sigs: Able to identify sandbox environment running process Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Attempts to identify external IP address Matched sigs: The input sample contains the RDTSCP instruction42:Tcfc,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\FLTLIB.DLL" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\MSVCP140.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\VCRUNTIME140.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\ucrtbase.DLL" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"43:Tcf7,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\FLTLIB.DLL" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\MSVCP140.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\ucrtbase.DLL" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"44:Tc3a,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe.config" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\newrock\" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.INI" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe.Local\" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe:Zone.Identifier" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe:Zone.Identifier" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\kos4.exe:Zone.Identifier" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\latestX.exe:Zone.Identifier" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.PDB" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\8A964D8FB52489BA9086BF0AB5CF8CA7822FE698D03E5E6D5174640F52B8C5EE.EXE.CONFIG" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\NEWROCK" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\8A964D8FB52489BA9086BF0AB5CF8CA7822FE698D03E5E6D5174640F52B8C5EE.INI" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" trying to access non-existent file "C:\8A964D8FB52489BA9086BF0AB5CF8CA7822FE698D03E5E6D5174640F52B8C5EE.EXE.LOCAL"45:T498,Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00000600-00000C2C-203672187") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00002160-00000C2C-207426118") Found reference to API "WinHttpOpenW" (Indicator: "WinHttpOpen"; Source: "00000000-00002160-00000C2C-207426193") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002160-00000C2C-224651317") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp")46:T771,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00000600-00000C2C-203672187") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00000600.00000000.76311.010D0000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001292.00000000.76234.00AC0000.00000002.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00001372.00000000.75725.002A0000.00000004.mdmp, 00000000-00001372.00000001.76242.002A0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00001372.00000000.75725.002A0000.00000004.mdmp, 00000000-00001372.00000001.76242.002A0000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001372.00000000.75725.018F0000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002160.00000000.76350.00A60000.00000002.mdmp, 00000000-00002160.00000001.78275.00A60000.00000002.mdmp, 00000000-00002160.00000002.80195.00A60000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003468.00000000.77482.01100000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp")47:T194b,Heuristic match: "g|i.hu" Heuristic match: "*n.ie" Heuristic match: "iplogger.com" Heuristic match: "stim.graspalace.com" Pattern match: "https://statsexplorer.org" Pattern match: "http://stim.graspalace.com/order/tuc19.exeset-cookie" Heuristic match: "pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.ws" Heuristic match: "ttps://statsexplorer.org" Pattern match: "http://3ebu257qh2dlauxqj7cgv3i55e4orb55mwgqf4tq7eicsa3dfhr4aaid.onion" Heuristic match: "p9.hn" Heuristic match: "se;.wsf;.ws" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: ">>01020b1c1115005f5c4e061704171b001d03091c1310114b0c1a0200b1c1115494a5c52100110515d52141b57170d14161d12025206141340084056005707170746501e16121203571c1452160c10121450010500175112041a055b0c0b0a070b1108031m0kd5251371f362b4011042b13043a2d223e0f19152c2014093e313d075d110f3d082e500231029141540z241028141540z020b1c1115005f5c4e061704171b001d03091c1310114b0c1a0200b1c1115494a5c52100110515d52141b57170d14161d12025206141340084056005707170746501e16121203571c1452160c10121450010500175112041a055b0c0b0a070b1108031m0kd5251371f362b4011042b13043a2d223e0f19152c2014093e313d075d110f3d082e500" - Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found URL "https://statsexplorer.orghttps://statsexplorer.orgh?" - Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found URL "https://statsexplorer.orgae/7" - Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found URL "https://statsexplorer.orghttp://3ebu257qh2dlauxqj7cgv3i55e4orb55mwgqf4tq7eicsa3dfhr4aaid.onion" - Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found URL "https://iplogger.com/2lhi52vmtoolssystemoftware\policies\microsoft\systemcertificates\disallowedoftware\policies\microsoft\systemcertificates\disallowedalrpc:[dnsresolver,security=impersonation" - Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.com0/0-0+%http://c.pki.goog/we1/4y3jdvkomeg.crl0wwkfwyxs" - Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:9u1.2.840.10046.2.16u1.2.840.113549.1.1.19u1.2.840.10040.4.175u1.2.840.113549.1.1.19u1.2.840.113549.1.3.19u1.2.840.10040.4.1:u1.2.840.113549.1.9.20:u1.2.840.113549.1.9.21-;u1.3.6.1.4.1.311.10.2:u1.3.6.1.4.1.311.2.1.27:u1.2.840.113549.1.9.15);u1.3.6.1.5.5.7.1.1);u1.3.6.1.5.5.7.1.11:u1.3.6.1.4.1.311.20.2:u1.3.6.1.4.1.311.13.2.3:u2.16.840.1.113730.1.1:u2.16.840.1.113730.1.2:u2.16.840.1.113730.1.3:u2.16.840.1.113730.1.4:u2.16.840.1.113730.1.7:u2.16.840.1.113730.1.8:u2.16.840.1.113730.1.12:u2.16.840.1.113730.1.13:u1.3.6.1.4.1.311.13.2.1:u1.3.6.1.4.1.311.21.1:u1.3.6.1.4.1.311.2.1.10:u1.3.6.1.4.1.311.21.3:u1.3.6.1.4.1.311.21.4:u1.3.6.1.4.1.311.21.2:u1.3.6.1.4.1.311.21.10:u1.3.6.1.4.1.311.21.11:u1.3.6.1.4.1.311.21.12<" - Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:globalsign" - Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:7w4ygil" - Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&vj" - Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:;egl3lssruuuhkssm,a" - Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,k't" - Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcp1<92a@ef)" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o0a0" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl>qq1nej-+\lu>gvpob\hzagxr" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?u3" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lm4uxldm4u0lj4u8m" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.com0/0-0+%http://c.pki.goog/we1/4y3jdvkomeg.crl0wwkfwyxs" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:ejd" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&voot" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:," - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&qw>*" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0$$ne&65qkdwj7jub:)$xvqvu/f*b5aw>lm,t8nz[)!yty>rlv8o$.n75g/,ll" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:vj" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:google" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&x+s)google" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:m" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:w$w^8$w^*" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gw^crgoogle" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://i.pki.goog/uw^.c&0$0" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0yu5,1[?ep[?:+" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://p^i./we1.crt0'p^ge*.iplogger.com0/0-0+p^ttc.pki.goog/we1/4y3jdvkp^.cp^m" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/g;p^crp^9" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:m*[io89v:peqvr\1rfe.3cb>jarwyaqw>*y" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&xx" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&kwksh" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://i.pki.goog/we1.ciplogger.com*.iplogger.com0/0-0+c.pki.goog/we1/4y3jdvkomeg.crl0wwkf]fxk9" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://i.pki.goog/sb$0" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0yu5,1[?ep[?:google" - Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp") Found URL "https://iplogger.com/2lhi52vmtoolssystemoftware\policies\microsoft\systemcertificates\disallowedoftware\policies\microsoft\systemcertificates\disallowedalrpc:[dnsresolver,security=impersonation" - Source: "00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.com0/0-0+%http://c.pki.goog/we1/4y3jdvkomeg.crl0wwkfwyxs" - Source: "00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:9u1.2.840.10046.2.16u1.2.840.113549.1.1.19u1.2.840.10040.4.175u1.2.840.113549.1.1.19u1.2.840.113549.1.3.19u1.2.840.10040.4.1:u1.2.840.113549.1.9.20:u1.2.840.113549.1.9.21-;u1.3.6.1.4.1.311.10.2:u1.3.6.1.4.1.311.2.1.27:u1.2.840.113549.1.9.15);u1.3.6.1.5.5.7.1.1);u1.3.6.1.5.5.7.1.11:u1.3.6.1.4.1.311.20.2:u1.3.6.1.4.1.311.13.2.3:u2.16.840.1.113730.1.1:u2.16.840.1.113730.1.2:u2.16.840.1.113730.1.3:u2.16.840.1.113730.1.4:u2.16.840.1.113730.1.7:u2.16.840.1.113730.1.8:u2.16.840.1.113730.1.12:u2.16.840.1.113730.1.13:u1.3.6.1.4.1.311.13.2.1:u1.3.6.1.4.1.311.21.1:u1.3.6.1.4.1.311.2.1.10:u1.3.6.1.4.1.311.21.3:u1.3.6.1.4.1.311.21.4:u1.3.6.1.4.1.311.21.2:u1.3.6.1.4.1.311.21.10:u1.3.6.1.4.1.311.21.11:u1.3.6.1.4.1.311.21.12<" - Source: "00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:globalsign" - Source: "00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:7w4ygil" - Source: "00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,k't" - Source: "00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcp1<92a@ef)" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o0a0" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl>qq1nej-+\lu>gvpob\hzagxr" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?u3" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lm4uxldm4u0lj4u8m" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.com0/0-0+%http://c.pki.goog/we1/4y3jdvkomeg.crl0wwkfwyxs" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:ejd" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0$$ne&65qkdwj7jub:)$xvqvu/f*b5aw>lm,t8nz[)!yty>rlv8o$.n75g/,ll" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:)ip^vj" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:wdyqxx" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&p^," - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/qp^.c@az&," - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0p3cj09%s[6" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&rwyabrw^," - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&v.com*.iplogger.com0," - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&sw^0," - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&sw^wy," - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&>z" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&m" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&2xw^," - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&[xw^," - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&%yw^," - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&nyw^," - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&tls-server-end-point:mi" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:6wp7pl)zp^ry6wp7pl)z6wp7pl)z6wp7pl)z6wp7pl)z6wp7pl)z6wp7pl)z6wp7pl)z6wp76wp7pl)zpl)zgoogle" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&%bw+s83w^&3w^l3w^z3w^" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger./0-0+%http://c.pki.goog/we1/4y3jdvkomeg.crl0wwkfwyxs" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.go=t^/r@az&globalsign" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:t^wgm*[io89v:peqvr\1rfe.3cb>jarwyaqw>**0(0&http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:lmem" - Source: "00000000-00002160.00000002.80195.04860000.00000004.mdmp") Found URL "https://statsexplorer.orghttp://3ebu257qh2dlauxqj7cgv3i55e4orb55mwgqf4tq7eicsa3dfhr4aaid.onionc:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exec:\windows\system32\kernel32.dll<<>>0100z0%<<>>010\0z0%<<>>010\0z0%<<>>010d5251371f362b4011042b13043a2d223e0f19152c2014093e313d075d110f3d082e50d5251371f362b4011042b13043a2d223e0f19152c2014093e313d075d110f3d082e50d5251371f362b4011042b13043a2d223e0f19152c2014093e313d075d110f3d082e50d5251371f362b4011042b13043a2d223e0f19152c2014093e313d075d110f3d082e50d5251371f362b4011042b13043a2d223e0f19152c2014093e313d075d110f3d082e50d5251371f362b4011042b13043a2d223e0f19152c2014093e313d075d110f3d082e50" - Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found URL "http://3ebu257qh2dlauxqj7cgv3i55e4orb55mwgqf4tq7eicsa3dfhr4aaid.onionhttp://3ebu257qh2dlauxqj7cgv3i55e4orb55mwgqf4tq7eicsa3dfhr4aaid.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\testappcommonprogramfiles=c:\program" - Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found URL "https://statsexplorer.orghttps://statsexplorer.org*struct" - Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found URL "http://3ebu257qh2dlauxqj7cgv3i55e4orb55mwgqf4tq7eicsa3dfhr4aaid.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2ac:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exe" - Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found URL "https://statsexplorer.org2026/09/03" - Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp")49:T407,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00000600.00000001.77164.00290000.00000004.mdmp") Found string ":\Windows\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp, 00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp, 00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp, 00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp, 00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003468.00000000.77482.001B0000.00000004.mdmp, 00000000-00003468.00000001.77659.001B0000.00000004.mdmp")4a:T8c7,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "7183244,3692,3216,,LookupAccountSidA,advapi32.dll,"252:32:31.913",RX=0,PX=0" (Indicator: "LookupAccountSid"; Source: "00000000-00000600.00000001.77164.00301000.00000004.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp")4b:Teac,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00001372) "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001372)4c:T58c,Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001372.00000001.76242.024F0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001372.00000001.76242.024F0000.00000004.mdmp") Found string "iption="Uses RsaCryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00002160.00000000.76350.003A0000.00000004.mdmp"), Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp 00000000-00002160.00000002.80195.003A0000.00000004.mdmp"), Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002160.00000001.78275.003A0000.00000004.mdmp 00000000-00002160.00000001.78275.04860000.00000004.mdmp 00000000-00002160.00000002.80195.003A0000.00000004.mdmp 00000000-00002160.00000002.80195.04860000.00000004.mdmp"), Found string "ECDSA_P256" (Indicator: "ecdsa"; Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp 00000000-00002160.00000002.80195.04860000.00000004.mdmp"), Found string "ECDSA_P384" (Indicator: "ecdsa"; Source: "00000000-00002160.00000001.78275.04860000.00000004.mdmp 00000000-00002160.00000002.80195.04860000.00000004.mdmp")4d:Te6b,Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API "[system process]Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp, 00000000-00001372.00000001.76242.024F0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00001372.00000001.76242.024F0000.00000004.mdmp")4e:T60b,Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00001372.00000001.76242.024F0000.00000004.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00002160.00000001.78275.001C2000.00000020.mdmp")4f:T82a,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00001372.00000001.76242.024F0000.00000004.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00002160.00000001.78275.001C2000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp")50:T116d,Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (Indicator: "\Device\"; Source: "00000000-00000600.00000001.77164.00290000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000600.00000001.77164.00290000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000600.00000001.77164.00290000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000600.00000001.77164.00290000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000600.00000001.77164.00290000.00000004.mdmp") Found string "indows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000600.00000001.77164.00290000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000600.00000001.77164.00290000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\toolspub2.exe" (Indicator: "\Device\"; Source: "00000000-00001292.00000000.76234.00192000.00000040.mdmp, 00000000-00001292.00000001.76267.00192000.00000040.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001372.00000000.75725.002A0000.00000004.mdmp, 00000000-00001372.00000001.76242.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001372.00000001.76242.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001372.00000001.76242.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001372.00000001.76242.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001372.00000001.76242.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001372.00000001.76242.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001372.00000001.76242.002A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002160.00000000.76350.003A0000.00000004.mdmp, 00000000-00002160.00000001.78275.003A0000.00000004.mdmp, 00000000-00002160.00000002.80195.003A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000000.77482.001B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (Indicator: "\Device\"; Source: "00000000-00003468.00000000.77482.001B0000.00000004.mdmp, 00000000-00003468.00000001.77659.001B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000000.77482.001B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000000.77482.001B0000.00000004.mdmp, 00000000-00003468.00000001.77659.001B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000000.77482.001B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000000.77482.001B0000.00000004.mdmp, 00000000-00003468.00000001.77659.001B0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000000.77482.001B0000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.77659.001B0000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003468.00000001.77659.001B0000.00000004.mdmp")51:T535,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000000.76234.00401000.00000020.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001292.00000000.76234.00401000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001372.00000000.75725.034F0000.00000004.mdmp")52:Ta2b,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "")53:T1050,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVERS"; Value: "https://statsexplorer.org") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "UUID"; Value: "000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "FIRSTINSTALLDATE"; Value: "FE0B996A0000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVICEVERSION"; Value: "000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "PGDSE"; Value: "000000000000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVERSVERSION"; Value: "C30000000000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "OSCAPTION"; Value: "Microsoft Windows 7 Professional") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "OSARCHITECTURE"; Value: "32-bit") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "ISADMIN"; Value: "3100000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "AV"; Value: "000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "PATCHTIME"; Value: "000000000000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "CPU"; Value: "Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz"), "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "GPU"; Value: "VMware SVGA 3D"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000"), "kos4.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\KOS4_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing"), "kos4.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\137\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")54:T457,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini"55:T709,"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" wrote 50176 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub2.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" wrote 11664 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" wrote 8192 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\kos4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe" wrote 42264 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\latestX.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...56:T4f2,Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00000600.00000001.77164.00290000.00000004.mdmp, 00000000-00000600.00000001.77164.00301000.00000004.mdmp") Found string "WbemScripting.SWbemLocator" (Indicator: "wbemscripting."; in Source: "00000000-00000600.00000001.77164.00290000.00000004.mdmp, 00000000-00000600.00000001.77164.0B400000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00000600.00000001.77164.00301000.00000004.mdmp") Found string "WbemScripting.SWbemLocator" (Indicator: "wbemscripting."; in Source: "00000000-00003468.00000000.77482.001B0000.00000004.mdmp, 00000000-00003468.00000001.77659.001B0000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003468.00000001.77659.001B0000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003468.00000001.77659.001B0000.00000004.mdmp") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp") Found string "wmiprvse.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00003468.00000001.77659.0B800000.00000004.mdmp")57:T7a7,"31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter System" (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00000600) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter System" (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter lsm.exe" (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00003468) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "Process32NextW with parameter spoolsv.exe" (UID: 00000000-00003468)58:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790364356233,"unified_at":"2026-09-25T19:25:56.233Z","metadata":{"hashes":{"sha256":"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","sha1":"0e3ada17305b7478bb456f5ad5eb73a400a78683","md5":"f99fa1c0d1313b7a5dc32cd58564671d","sha512":"bbee03761f2ffe4ab99d3e2dd02f49460b1100583ceb0e06f2765eff776d3167880a8dbbb8079c659d39fc3cc8e24dfdd8395ced3eeb6a13ef598ba8b9269a25","ssdeep":"196608:yqG6fth+H4TaduMID/AsrzwBiaBYJwQwvk5KTOYTa+tH/+MpZG:5FhgID/A9BiaBYJwQk8Z+YMpZ","ssdeep_chunks":["196608:yqG6fth","196608:qG6fth+","196608:G6fth+H","196608:6fth+H4","196608:fth+H4T","196608:th+H4Ta","196608:h+H4Tad","196608:+H4Tadu","196608:H4TaduM","196608:4TaduMI","196608:TaduMID","196608:aduMID/","196608:duMID/A","196608:uMID/As","196608:MID/Asr","196608:ID/Asrz","196608:D/Asrzw","196608:/AsrzwB","196608:AsrzwBi","196608:srzwBia","196608:rzwBiaB","196608:zwBiaBY","196608:wBiaBYJ","196608:BiaBYJw","196608:iaBYJwQ","196608:aBYJwQw","196608:BYJwQwv","196608:YJwQwvk","196608:JwQwvk5","196608:wQwvk5K","196608:Qwvk5KT","196608:wvk5KTO","196608:vk5KTOY","196608:k5KTOYT","196608:5KTOYTa","196608:KTOYTa+","196608:TOYTa+t","196608:OYTa+tH","196608:YTa+tH/","196608:Ta+tH/+","196608:a+tH/+M","196608:+tH/+Mp","196608:tH/+MpZ","196608:H/+MpZG","393216:yqG6fth","393216:qG6fth+","393216:G6fth+H","393216:6fth+H4","393216:fth+H4T","393216:th+H4Ta","393216:h+H4Tad","393216:+H4Tadu","393216:H4TaduM","393216:4TaduMI","393216:TaduMID","393216:aduMID/","393216:duMID/A","393216:uMID/As","393216:MID/Asr","393216:ID/Asrz","393216:D/Asrzw","393216:/AsrzwB","393216:AsrzwBi","393216:srzwBia","393216:rzwBiaB","393216:zwBiaBY","393216:wBiaBYJ","393216:BiaBYJw","393216:iaBYJwQ","393216:aBYJwQw","393216:BYJwQwv","393216:YJwQwvk","393216:JwQwvk5","393216:wQwvk5K","393216:Qwvk5KT","393216:wvk5KTO","393216:vk5KTOY","393216:k5KTOYT","393216:5KTOYTa","393216:KTOYTa+","393216:TOYTa+t","393216:OYTa+tH","393216:YTa+tH/","393216:Ta+tH/+","393216:a+tH/+M","393216:+tH/+Mp","393216:tH/+MpZ","393216:H/+MpZG","196608:5FhgID/","196608:FhgID/A","196608:hgID/A9","196608:gID/A9B","196608:ID/A9Bi","196608:D/A9Bia","196608:/A9BiaB","196608:A9BiaBY","196608:9BiaBYJ","196608:aBYJwQk","196608:BYJwQk8","196608:YJwQk8Z","196608:JwQk8Z+","196608:wQk8Z+Y","196608:Qk8Z+YM","196608:k8Z+YMp","196608:8Z+YMpZ"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"file.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":10347008,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1698690927000,"last_seen":1788413976000,"last_multi_scan":1788413976000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","criminal","smokeloader","downloader","evasive"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":95},"sandbox_signatures":{"informative_count":224,"suspicious_count":20,"malicious_count":12,"total":256},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"IL:Trojan.ClipBanker.56","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"IL:Trojan.ClipBanker.56 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.UZA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"VirTool/MSIL.Obfuscator.su","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005a8b921 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/ILAgent-I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-FVZC!F99FA1C0D131","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.FFY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.TZV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3753615","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"IL:Trojan.ClipBanker","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"SmokeLoader","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to discover operating system information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes shellcode to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"},{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Able to detect if debugger is present"},{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment"},{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Able to identify virtual/sandbox environment devices"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns many processes"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"},{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find a SID for the specified name"},{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"suspicious","value":"Calls an API typically used to retrieve the current status of the specified service"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Able to download remote files (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: sample.bin, Indicator: \"select * from win32_computersystem\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"Found reference to API \"Select * from Win32_ComputerSystem\" (Indicator: \"select\"; Source: \"sample.bin\"), Found reference to API \"lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\" (Indicator: \"read\"; Source: \"sample.bin\"), Found reference to API \"lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\" (Indicator: \"time\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"SbieDll.dll\" (Indicator: \"sbiedll.dll\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"dd_dotnet48_decompression_log.txt\" (Source: \"00000000-00001372.00000001.76242.002A0000.00000004.mdmp\")\n Found string \"dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt\" (Source: \"00000000-00001372.00000001.76242.047C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$22","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"kos4.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"kos4.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$23","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$24","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00002160-00000CC3-212465951\")\n Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00002160.00000001.78275.003A0000.00000004.mdmp, 00000000-00002160.00000002.80195.003A0000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00002160.00000001.78275.04860000.00000004.mdmp, 00000000-00002160.00000002.80195.04860000.00000004.mdmp\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00002160.00000001.78275.04860000.00000004.mdmp, 00000000-00002160.00000002.80195.04860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00001372.00000000.75725.00198000.00000004.mdmp\n 00000000-00001372.00000001.76242.00198000.00000004.mdmp\n Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00002160.00000000.76350.00309000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee has big resource with name: \"toolspub2\" size: \"181248\" and abnormal entropy:\"7.513763783447973\"\n 8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee has big resource with name: \"latestX\" size: \"5874968\" and abnormal entropy:\"7.8217005845593945\"\n 8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee has big resource with name: \"31839b57a4f11171d6abc8bbc4451ee4\" size: \"4271504\" and abnormal entropy:\"7.997424562158198\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001292.00000000.76234.00192000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001292.00000001.76267.00192000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001292.00000001.76267.002C0000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001372.00000001.76242.024F0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003496.00000000.76535.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2; Source: \"00000000-00000600.00000001.77164.00290000.00000004.mdmp, 00000000-00000600.00000001.77164.00301000.00000004.mdmp\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00003468.00000001.77659.001B0000.00000004.mdmp\")\n Found string - \\\\.\\VBoxGuest; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")\n Found string - \\\\.\\VBoxTrayIPC; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")\n Found string - \\\\.\\VBoxMiniRdrDN; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$25","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" queried SystemProcessInformation at 00000000-00000600-00000105-17835498 [PID: 600]\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" queried SystemProcessInformation at 00000000-00003468-00000105-7174856 [PID: 3468]\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" queried SystemProcessInformation at 00000000-00003468-00000105-7189778 [PID: 3468]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Able to detect if debugger is present","description":"Observed API \"CheckRemoteDebuggerPresent\" in \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\"\n Observed API \"CheckRemoteDebuggerPresent\" in \"kos4.exe\"","origin":"Static Parser","mitre_attack_id":"T1622","relevance":1,"id":"static-220","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProter\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002160.00000000.76350.003A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00002160-00000C2C-212461590\")\n Found reference to API \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00002160-00000C2C-212465055\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00002160-00000C2C-212465260\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProter\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002160.00000000.76350.003A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"iption=\"Uses RsaCryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002160.00000000.76350.003A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000600.00000001.77164.00290000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001292.00000000.76234.00192000.00000040.mdmp, 00000000-00001292.00000001.76267.00192000.00000040.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001372.00000000.75725.002A0000.00000004.mdmp, 00000000-00001372.00000001.76242.002A0000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002160.00000000.76350.003A0000.00000004.mdmp, 00000000-00002160.00000001.78275.003A0000.00000004.mdmp, 00000000-00002160.00000002.80195.003A0000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003468.00000000.77482.001B0000.00000004.mdmp, 00000000-00003468.00000001.77659.001B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002160.00000001.78275.003A0000.00000004.mdmp, 00000000-00002160.00000002.80195.003A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.93169","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$27","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$28","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002160-00000C2C-204190521\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"[system process]vboxtray.exe\" (Indicator: \"vboxtray.exe\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")\n Found string \"vboxservice.exe\" (Indicator: \"vboxservice.exe\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")\n Found string \"vboxtray.exe\" (Indicator: \"vboxtray.exe\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")\n Found string \"vgauthservice.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002160-00000C2C-204190521\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"vboxguestadditions\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00001292.00000000.76234.001A5000.00000004.mdmp\")\n Found string \"24,9,$name,2,0,,\"VBoxGuestY\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00001292.00000000.76234.001A5000.00000004.mdmp\"), Found string \"\\\\.\\VBoxGuest\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\"), Found string \"VBoxWddm\" (Indicator: \"VBoxWddm\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\"), Found string \"VBoxMouse\" (Indicator: \"VBoxMouse\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\"), Found string \"VBoxGuest\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\"), Found string \"VBoxSF\" (Indicator: \"VBoxSF\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"\\\\.\\VBoxGuest\" (Indicator: \"\\vboxguest\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")\n Found string \"\\\\.\\VBoxTrayIPC\" (Indicator: \"\\vboxtrayipc\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")\n Found string \"\\\\.\\VBoxMiniRdrDN\" (Indicator: \"\\vboxminirdrdn\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")\n Found string \"\\\\.\\pipe\\VBoxMiniRdDN\" (Indicator: \"\\pipe\\vboxminirddn\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")\n Found string \"\\\\.\\pipe\\VBoxTrayIPC\" (Indicator: \"\\vboxtrayipc\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001372-00000C2C-192606112\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001372-00000C2C-192606840\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001372-00000C2C-196304768\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceConfigW\" (Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found string \"QueryServiceStatusEx\" (Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found string \"QueryServiceStatusEx\" (Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002160-00000C2C-210189547\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; Source: \"00000000-00001292-00000C2C-201161542\")\n Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00001372)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001372)\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001372)\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00001372)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001372)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001372)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"IsWow64Process\" with parameter \"1372\" - (UID: 00000000-00001372)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"IsWow64Process\" with parameter \"600\" - (UID: 00000000-00000600)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001372)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00000600)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00000600)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00000600)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidA\" with param Name SYSTEM (UID: 00000000-00000600)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003468)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003468)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001372)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\"\n Observed namespace \"System.Management.ManagementObjectSearcher\" in \"kos4.exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"toolspub2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"toolspub2.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"kos4.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"c:\\windows\\rss\\csrss.exeGetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"c:\\windows\\rss\\csrss.exeGetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"8435394,1924,3024,,RtlGetVersion,NTDLL.dll,\"252:05:23.024\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00001292.00000000.76234.001A5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" queries volume information of \"C:\\8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" at 00000000-00001372-0000010C-3421779\n \"kos4.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\kos4.exe\" at 00000000-00002160-0000010C-3715613","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"kos4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"kos4.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$30","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT Name FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found string \"SELECT Name FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup Domain (iplogger .com in TLS SNI)\" (SID: 2047718, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"kos4.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"file/memory contains long string(File: \"kos4.exe\")\n Found string \"at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo startInfo)\" (Source: \"00000000-00001372.00000001.76242.024F0000.00000004.mdmp, 00000000-00001372.00000001.76242.047C0000.00000004.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00001372.00000001.76242.024F0000.00000004.mdmp\")\n Found string \"ProcessStartInfo startInfo\" (Source: \"00000000-00001372.00000001.76242.024F0000.00000004.mdmp\")\n Found string \"ProcessStartInfo\" (Source: \"00000000-00002160.00000001.78275.001C2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileA\"; File: \"toolspub2.exe\")\n Found string \"MoveFileWithProgressA\" (Indicator: \"MoveFileW\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found string \"MoveFileWithProgressA\" (Indicator: \"MoveFileW\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found string \"MoveFileWithProgressA\" (Indicator: \"MoveFileW\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"toolspub2.exe\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$31","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00001372)\n \"kos4.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00002160)\n \"kos4.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00002160)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\toolspub2.exe\"\" - (UID: 00000000-00001372)\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe\"\" - (UID: 00000000-00001372)\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\kos4.exe\"\" - (UID: 00000000-00001372)\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\latestX.exe\"\" - (UID: 00000000-00001372)\n \"toolspub2.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\toolspub2.exe\"\" - (UID: 00000000-00001292)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$33","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.76.57:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")\n Found reference to API \"at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo startInfo)\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001372.00000001.76242.024F0000.00000004.mdmp, 00000000-00001372.00000001.76242.047C0000.00000004.mdmp\")\n Found reference to API \"StartWithShellExecuteEx\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001372.00000001.76242.024F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileWithProgressA\" (Indicator: \"MoveFile\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileWithProgressA\" (Indicator: \"MoveFile\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileWithProgressA\" (Indicator: \"MoveFile\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\"\n Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"kos4.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"kos4.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.get_StartInfo\" in \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\"\n Observed function \"Process.Start\" in \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\"\n Observed function \"Process.get_StartInfo\" in \"kos4.exe\"\n Observed function \"Process.Start\" in \"kos4.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$35","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileA in import section (Source: 31839b57a4f11171d6abc8bbc4451ee4.exe)\n Found MoveFileA in import section (Source: toolspub2.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process 8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process 8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process kos4.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process kos4.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"kos4.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"kos4.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"info@diginotar.nl\"\n Pattern match: \"cps-requests@verisign.com\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"GetModuleHandle\" in \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\"\n Observed unmanaged function \"CheckRemoteDebuggerPresent\" in \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\"\n Observed unmanaged function \"GetModuleHandle\" in \"kos4.exe\"\n Observed unmanaged function \"CheckRemoteDebuggerPresent\" in \"kos4.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\VBoxMiniRdDN\n Found string - \\\\.\\pipe\\VBoxTrayIPC","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$38","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 759F0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$39","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 62F00000\n \"kos4.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 62F00000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74D80000\n \"kos4.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74D80000\n \"kos4.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74940000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 63B60000\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64310000\n \"kos4.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64310000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76ED0000\n \"toolspub2.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76ED0000\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76ED0000\n \"kos4.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76ED0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1500160020731472@ADVAPI32.dll\"\n \"0e000f00e4731472@ADVAPI32.dll\"\n \"0e000f0050741472@ADVAPI32.dll\"\n \"11001200d47d1472@ADVAPI32.dll\"\n \"110012007c7e1472@ADVAPI32.dll\"\n \"12001300cc7e1472@ADVAPI32.dll\"\n \"12001300387f1472@ADVAPI32.dll\"\n \"14001500e4b71472@ADVAPI32.dll\"\n \"1400150000b81472@ADVAPI32.dll\"\n \"140015001cb81472@ADVAPI32.dll\"\n \"1700180038b81472@ADVAPI32.dll\"\n \"0d000e0054b81472@ADVAPI32.dll\"\n \"1100120064b81472@ADVAPI32.dll\"\n \"110012007cb81472@ADVAPI32.dll\"\n \"0f001000ecb91472@ADVAPI32.dll\"\n \"1400150038ba1472@ADVAPI32.dll\"\n \"1400150054ba1472@ADVAPI32.dll\"\n \"0c000d00a8ba1472@ADVAPI32.dll\"\n \"0c000d00b8ba1472@ADVAPI32.dll\"\n \"0e000f00c8ba1472@ADVAPI32.dll\"\n \"0e000f00dcba1472@ADVAPI32.dll\"\n \"0b000c00f0ba1472@ADVAPI32.dll\"\n \"180019008cbd1472@RPCRT4.dll\"\n \"13001400bcbd1472@RPCRT4.dll\"\n \"14001500d4bd1472@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\" was detected as \".NET\" and name: \"Library\"\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" was detected as \".NET\" and name: \"Library\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"toolspub2.exe\" was detected as \".NET\" and name: \"Library\"\n \"toolspub2.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"kos4.exe\" was detected as \".NET\" and name: \"Library\"\n \"kos4.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"kos4.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\" has an executable section named \".text\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has an executable section named \".text\"\n \"toolspub2.exe\" has an executable section named \".text\"\n \"kos4.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" has an writable section named \".data\"\n \"toolspub2.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3b","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x9dd800\" greater than 0x100000\n Raw size of \".text\" is \"0x40ac00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x9dd604\" greater than 0x100000\n Virtual size of \".text\" is \"0x40aaa2\" greater than 0x100000\n Virtual size of \".data\" is \"0x388bf4\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x185158\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"toolspub2.exe\" (UID: 00000000-00001292) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"toolspub2.exe\" (UID: 00000000-00001292) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00003468) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, HOMEPATH, TEMP, USERPROFILE, TMP, NUMBER_OF_PROCESSORS\"\n Process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00003468) was launched with missing environment variables: \"LOGONSERVER, USERDNSDOMAIN\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"iplogger.com\"\n \"stim.graspalace.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00001372.00000001.76242.002A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"toolspub2.exe\" (UID: 00000000-00001292)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00000600)\n Spawned process \"kos4.exe\" (UID: 00000000-00002160)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00003496)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00003468)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"toolspub2.exe\" (UID: 00000000-00001292)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00000600)\n Spawned process \"kos4.exe\" (UID: 00000000-00002160)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00003496)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00003468)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 3022823)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: EA:94:25:44:73:AA:8B:94:E1:0B:FC:C9:0C:4E:78:AF:A4:E0:85:12; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"toolspub2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"kos4.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\toolspub2.exe\"\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\31839b57a4f11171d6abc8bbc4451ee4.exe\"\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\kos4.exe\"\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\latestX.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" connecting to \"\\ThemeApiPort\"\n \"toolspub2.exe\" connecting to \"\\ThemeApiPort\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 3 sections\"- Location: [%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe]- [targetUID: 00000000-00000600]\n \"toolspub2.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 3 sections\"- Location: [%TEMP%\\toolspub2.exe]- [targetUID: 00000000-00001292]\n \"kos4.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\kos4.exe]- [targetUID: 00000000-00002160]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"kos4.exe\" queries basic process information of the \"C:\\Windows\\System32\\cryptsp.dll\" (UID: 2160)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$41","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\toolspub2.exe\"\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\31839b57a4f11171d6abc8bbc4451ee4.exe\"\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\kos4.exe\"\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\latestx.exe\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" writes file \"%temp%\\31839b57a4f11171d6abc8bbc4451ee4.exe\"\n \"toolspub2.exe\" writes file \"%temp%\\toolspub2.exe\"\n \"kos4.exe\" writes file \"%temp%\\kos4.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"kos4.exe\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"kos4.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping 0, GenuineIntel\" (Indicator: \"ping \"; Source: \"00000000-00000600.00000001.77164.00301000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00002160-00000C2C-206488588\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00000600)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"GetNamedPipeHandleStateW\" (Indicator: \"GetNamedPipe\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetNamedPipeHandleStateW\" (Indicator: \"GetNamedPipe\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetNamedPipeHandleStateW\" (Indicator: \"GetNamedPipe\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"kos4.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00002160.00000001.78275.04860000.00000004.mdmp\n 00000000-00002160.00000002.80195.04860000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$47","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$48","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"stim.graspalace.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"iplogger.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.76.57\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncacn_np\" (Indicator: \"ncacn_np\"; Source: \"00000000-00000600.00000001.77164.00290000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEBD702338FA9C4DECBD289A8472EA]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000600.00000001.77164.00301000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000600.00000001.77164.00301000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEBD702338FA9C4DECBD289A\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000600.00000001.77164.00301000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEE75C8BDE47634589AA32CE6AE645]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000600.00000001.77164.00301000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEBD702338FA9C4DECBD289A8472EA]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000600.00000001.77164.00301000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE519B9D610D324F2BAABDC1C5E0FA]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003468.00000000.77482.001B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$49","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"8435394,1924,3024,,RtlGetVersion,NTDLL.dll,\"252:05:23.024\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001292.00000000.76234.001A5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"BFilename=|DataDirectory|aspnetdb.mdf;User Instance=true\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001372.00000000.75725.002A0000.00000004.mdmp\"), Found string \"etdb.mdf;User Instance=true\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002160.00000001.78275.003A0000.00000004.mdmp, 00000000-00002160.00000002.80195.003A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" tries to directly access volume data \"C:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 731B0000\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\System32\\samlib.dll\" at 74070000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"toolspub2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"kos4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001292.00000000.76234.0012B000.00000004.mdmp, 00000000-00001292.00000001.76267.0012B000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003468.00000000.77482.0B880000.00000004.mdmp, 00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping 0, GenuineIntel\" (Indicator: \"ping\"; Source: \"00000000-00000600.00000001.77164.00301000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\tzres.dll\" (UID: 00000000-00000600), \"kos4.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\cryptsp.dll\" (UID: 00000000-00002160)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$50","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeImpersonatePrivilege\" (Indicator: \"SeImpersonatePrivilege\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"SeImpersonatePrivilege\" (Indicator: \"SeImpersonate\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilegeC\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"LsaAddAccountRights\" (Indicator: \"LsaAddAccountRights\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateToken\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateTokenEx\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"CopySid\" (Indicator: \"CopySid\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"GetLengthSid\" (Indicator: \"GetLengthSid\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002160-00000C2C-213853625","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001292.00000000.76234.00401000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001372.00000000.75725.034F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"kos4.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" opened \"\\Device\\KsecDD\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" opened \"\\Device\\KsecDD\"\n \"kos4.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$52","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$53","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00000600.00000001.77164.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"winlogon.exe,csrss.exe,smss.exe,wininit.exe,services.exe\" (Source: \"00000000-00003468.00000001.77659.0B800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 3 sections\"- Location: [%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe]- [targetUID: 00000000-00000600]\n \"toolspub2.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 3 sections\"- Location: [%TEMP%\\toolspub2.exe]- [targetUID: 00000000-00001292]\n \"kos4.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\kos4.exe]- [targetUID: 00000000-00002160]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"toolspub2.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"kos4.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"kos4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".text\" unusually large (10343940 bytes)\n possible junk padding","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" at 00000000-00000600-00000105-6972568\n \"kos4.exe\" at 00000000-00002160-00000105-5713460\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" at 00000000-00003468-00000105-4270361","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee\" has section name .text with entropy \"7.93194507830665\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has section name .text with entropy \"7.997435863403072\"\n \"toolspub2.exe\" has section name .text with entropy \"7.405069926541061\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO External IP Lookup Domain (iplogger .com in TLS SNI)\" (SID: 2047718, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$54","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 3 sections\"- Location: [%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe]- [targetUID: 00000000-00000600]\n \"toolspub2.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 3 sections\"- Location: [%TEMP%\\toolspub2.exe]- [targetUID: 00000000-00001292]\n \"kos4.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\kos4.exe]- [targetUID: 00000000-00002160]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$55","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.76.57 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE process \"00000000-00003496\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$56","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$57","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"%OSUSER%\"\n \"Sid\": \"188810176\"\n \"cbSid\": \"32000000\"\n \"ReferencedDomainName\": \"%OSUSER%-PC\"\n \"cchReferencedDomainName\": \"0a000000\"\n \"peUse\": \"01000000\"}\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"%OSUSER%\"\n \"Sid\": \"193011904\"\n \"cbSid\": \"32000000\"\n \"ReferencedDomainName\": \"%OSUSER%-PC\"\n \"cchReferencedDomainName\": \"0a000000\"\n \"peUse\": \"01000000\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve the current status of the specified service","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"QueryServiceStatusEx\" with parameters {\"hService\": \"30fbb8\"\n \"InfoLevel\": \"0\"\n \"lpBuffer\": \"189029540\"\n \"cbBufSize\": \"36\"\n \"pcbBytesNeeded\": \"36\"}","origin":"API Call","mitre_attack_id":"T1007","relevance":5,"id":"api-170","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"login.skype.com0\" (Indicator: \"skype.com\")\n \"login.skype.com\" (Indicator: \"skype.com\")\n \"www.login.skype.com0\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" claimed CRC 4320440 while the actual is CRC 4285449\n \"kos4.exe\" claimed CRC 234359 while the actual is CRC 48678","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateFileW\n GetModuleHandleExA\n GetTickCount\n UnhandledExceptionFilter\n GetStartupInfoA\n FindNextFileW\n GetStartupInfoW\n WriteFile\n Sleep\n DeleteFileW\n IsDebuggerPresent\n GetProcAddress\n GetTempPathW\n VirtualProtect\n CopyFileW\n GetDriveTypeA\n GetModuleHandleW\n LoadLibraryW\n FindFirstFileW\n TerminateProcess\n GetModuleFileNameW\n GetCommandLineW\n GetFileAttributesW\n GetModuleHandleA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"toolspub2.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\toolspub2.exe\"\" - (UID: 00000000-00001292)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 73 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/26 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"16/27 Antivirus vendors marked dropped file \"31839b57a4f11171d6abc8bbc4451ee4.exe\" as malicious (classified as \"Kryptik.httby\" with 59% detection rate)\n 12/27 Antivirus vendors marked dropped file \"toolspub2.exe\" as malicious (classified as \"Malware\" with 44% detection rate)\n 20/27 Antivirus vendors marked dropped file \"kos4.exe\" as malicious (classified as \"IL:Trojan.MSILZilla\" with 74% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"12/27 Antivirus vendors marked spawned process \"toolspub2.exe\" (PID: 1292) as malicious (classified as \"Malware\" with 44% detection rate)\n 16/27 Antivirus vendors marked spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (PID: 600) as malicious (classified as \"Kryptik.httby\" with 59% detection rate)\n 20/27 Antivirus vendors marked spawned process \"kos4.exe\" (PID: 2160) as malicious (classified as \"IL:Trojan.MSILZilla\" with 74% detection rate)\n 12/27 Antivirus vendors marked spawned process \"toolspub2.exe\" (PID: 3496) as malicious (classified as \"Malware\" with 44% detection rate)\n 16/27 Antivirus vendors marked spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (PID: 3468) as malicious (classified as \"Kryptik.httby\" with 59% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"iplogger.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_DLInjector04\" matched file \"kos4.exe\" as \"Detects downloader / injector\"\n YARA signature \"MALWARE_Win_DLInjector04\" matched file \"sample.bin\" as \"Detects downloader / injector\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe\" (UID: 00000000-00001372)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00001292)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00000600)\n Spawned process \"kos4.exe\" (UID: 00000000-00002160)\n Spawned process \"toolspub2.exe\" (UID: 00000000-00003496)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00003468)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Attempts to identify external IP address"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]}],"intel_graph":{"map":{"Domain:iplogger.com":{"type":"Domain","value":"iplogger.com"},"Domain:stim.graspalace.com":{"type":"Domain","value":"stim.graspalace.com"},"File:095e2b0ed70525cf5a7a5c31241aad5c27964fd69d68569c646a158c0ff50b47":{"type":"File","value":"095e2b0ed70525cf5a7a5c31241aad5c27964fd69d68569c646a158c0ff50b47"},"File:6fea30b9d17eacffde43b727058b5b2c422a7b70407534549042ba7b20d5f8c9":{"type":"File","value":"6fea30b9d17eacffde43b727058b5b2c422a7b70407534549042ba7b20d5f8c9"},"File:8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee":{"type":"File","value":"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as packed by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat SmokeLoader"]}},"File:cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd":{"type":"File","value":"cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd"},"Ip:104.21.76.57":{"type":"Ip","value":"104.21.76.57"},"Threat:ada9ac3ecf1aea7a80d89fa364bc17118165a13672a8093fe8ddd6109d5d9133":{"type":"Threat","value":"SmokeLoader","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1544944952554953502","root":"File:8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as packed by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat SmokeLoader"]}},{"id":"1544944947198982664","root":"File:8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","to_key":"Threat:ada9ac3ecf1aea7a80d89fa364bc17118165a13672a8093fe8ddd6109d5d9133"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","edges":[{"edge_kind":"contacted_ip","from_key":"File:8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","to_key":"Ip:104.21.76.57"},{"edge_kind":"contacted_domain","from_key":"File:8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","to_key":"Domain:iplogger.com"},{"edge_kind":"resolves_to","from_key":"Domain:iplogger.com","to_key":"Ip:104.21.76.57"},{"edge_kind":"contacted_domain","from_key":"File:8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","to_key":"Domain:stim.graspalace.com"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","edges":[{"edge_kind":"extracted","from_key":"File:8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","to_key":"File:6fea30b9d17eacffde43b727058b5b2c422a7b70407534549042ba7b20d5f8c9"},{"edge_kind":"extracted","from_key":"File:8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","to_key":"File:cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd"},{"edge_kind":"extracted","from_key":"File:8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","to_key":"File:095e2b0ed70525cf5a7a5c31241aad5c27964fd69d68569c646a158c0ff50b47"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":136,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":7,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","criminal","smokeloader","downloader","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a990816744009f79d07ebb6","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"IL:Trojan.ClipBanker","submit_name":"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","analysis_start_time":"2026-09-03T05:39:37+00:00","indicators_count":{"informative":223,"suspicious":42,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.76.57","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]}],"dns_resolutions":[{"domain":"iplogger.com","address":"104.21.76.57","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"domain":"stim.graspalace.com","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}],"processes":[{"pid":1372,"ppid":0,"name":"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe","command_line":"","sha256":"8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee","normalized_path":"C:\\8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee.exe","uid":"00000000-00001372","icon":"$58"},{"pid":1292,"ppid":1372,"name":"toolspub2.exe","command_line":"","sha256":"095e2b0ed70525cf5a7a5c31241aad5c27964fd69d68569c646a158c0ff50b47","normalized_path":"%TEMP%\\toolspub2.exe","parent_uid":"00000000-00001372","uid":"00000000-00001292"},{"pid":3496,"ppid":1292,"name":"toolspub2.exe","command_line":"","sha256":"095e2b0ed70525cf5a7a5c31241aad5c27964fd69d68569c646a158c0ff50b47","normalized_path":"%TEMP%\\toolspub2.exe","parent_uid":"00000000-00001292","uid":"00000000-00003496"},{"pid":600,"ppid":1372,"name":"31839b57a4f11171d6abc8bbc4451ee4.exe","command_line":"","sha256":"6fea30b9d17eacffde43b727058b5b2c422a7b70407534549042ba7b20d5f8c9","normalized_path":"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe","parent_uid":"00000000-00001372","uid":"00000000-00000600"},{"pid":3468,"ppid":600,"name":"31839b57a4f11171d6abc8bbc4451ee4.exe","command_line":"","sha256":"6fea30b9d17eacffde43b727058b5b2c422a7b70407534549042ba7b20d5f8c9","normalized_path":"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe","parent_uid":"00000000-00000600","uid":"00000000-00003468"},{"pid":2160,"ppid":1372,"name":"kos4.exe","command_line":"","sha256":"cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd","normalized_path":"%TEMP%\\kos4.exe","parent_uid":"00000000-00001372","uid":"00000000-00002160"}],"all_imported_dlls":["wininet.dll","sspicli.dll","winhttp.dll","bcrypt.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","shdocvw.dll","System.Configuration.ni.dll","schannel.dll","nsi.dll","ucrtbase.dll","rsaenh.dll","ntdsapi.dll","msasn1.dll","kernel32.dll","vcruntime140_clr0400.dll","wbemcomn.dll","urlmon.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","msvcr100.dll","cryptsp.dll","mswsock.dll","mscoreei.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","rtutils.dll","ncrypt.dll","VxSSL32.dll","wmiutils.dll","tzres.dll","advapi32.dll","api-ms-win-crt-stdio-l1-1-0.dll","RpcRtRemote.dll","fltLib.dll","msvcp140.dll","cfgmgr32.dll","Wldap32.dll","apphelp.dll","secur32.dll","WSHTCPIP.DLL","bcryptprimitives.dll","iertutil.dll","dnsapi.dll","msvcrt.dll","samlib.dll","rasman.dll","sechost.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","uxtheme.dll","devobj.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","rasapi32.dll","ws2_32.dll","api-ms-win-crt-locale-l1-1-0.dll","cryptbase.dll","System.ni.dll","psapi.dll","mscorrc.dll","powrprof.dll","api-ms-win-core-synch-l1-2-0.dll","ntmarta.dll","msimg32.dll","System.Xml.ni.dll","imm32.dll","winmm.dll","winsta.dll","fastprox.dll","clr.dll","dwmapi.dll","user32.dll","ucrtbase_clr0400.dll","comctl32.dll","dhcpcsvc6.dll","gdi32.dll","mscoree.dll","KernelBase.dll","rpcrt4.dll","shlwapi.dll","diasymreader.dll","wtsapi32.dll","wbemdisp.dll","setupapi.dll","wbemprox.dll","winnsi.dll","crypt32.dll","vcruntime140.dll","ole32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","webio.dll","wship6.dll","lpk.dll","api-ms-win-core-processthreads-l1-1-1.dll","version.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","normaliz.dll","sxs.dll","netapi32.dll","srvcli.dll","api-ms-win-core-file-l1-2-0.dll","wbemcomn2.dll","usp10.dll","api-ms-win-crt-utility-l1-1-0.dll","msctf.dll","propsys.dll","nlssorting.dll","rasadhlp.dll","api-ms-win-core-timezone-l1-1-0.dll","shell32.dll","wbemsvc.dll","IPHLPAPI.DLL","ntdll.dll","System.Core.ni.dll","profapi.dll","FWPUCLNT.DLL","api-ms-win-crt-math-l1-1-0.dll","oleaut32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","wkscli.dll","samcli.dll","credssp.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-string-l1-1-0.dll","mscorlib.ni.dll","api-ms-win-core-xstate-l2-1-0.dll","clbcatq.dll","wshqos.dll","clrjit.dll","userenv.dll","rpcss.dll","netutils.dll","api-ms-win-crt-heap-l1-1-0.dll","dhcpcsvc.dll","gpapi.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"31839b57a4f11171d6abc8bbc4451ee4.exe","sha256":"6fea30b9d17eacffde43b727058b5b2c422a7b70407534549042ba7b20d5f8c9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"name":"kos4.exe","sha256":"cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"name":"toolspub2.exe","sha256":"095e2b0ed70525cf5a7a5c31241aad5c27964fd69d68569c646a158c0ff50b47","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]}],"files_written":[{"path":"%TEMP%\\toolspub2.exe","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"path":"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"path":"%TEMP%\\kos4.exe","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"path":"%TEMP%\\latestX.exe","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\483F7B2A\\","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\KOS4_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6a990816744009f79d07ebb6"}]}]}},"report_ids":{"sandbox_job_ids":["6a990816744009f79d07ebb6"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious IL:Trojan.ClipBanker Sample 8a964d8fb524… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8a964d8fb524…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 18/27 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee"}],["$","meta","4",{"property":"og:title","content":"Malicious IL:Trojan.ClipBanker Sample 8a964d8fb524… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8a964d8fb524…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 18/27 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8a964d8fb52489ba9086bf0ab5cf8ca7822fe698d03e5e6d5174640f52b8c5ee"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious IL:Trojan.ClipBanker Sample 8a964d8fb524… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8a964d8fb524…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 18/27 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L59","11",{}]]