26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 8d5a14be495d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8d5a14be495d…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 3/27 AV engines flagged this file. 11 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8d5a14be495da026ed5c5ad37667faf349317ad31f5928de4e353db0e99031ab","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","8d5a14be495da026ed5c5ad37667faf349317ad31f5928de4e353db0e99031ab"],"about":{"@type":"SoftwareApplication","name":"NA_8d5a14be495da026ed5c5ad37.exe","applicationCategory":["peexe","executable"],"identifier":"8d5a14be495da026ed5c5ad37667faf349317ad31f5928de4e353db0e99031ab","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5c1,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp")28:T53f,Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp")29:T1440,Assembly shows XOR instruction xor al bl in Stream UID: 00000000-00001188-35121-4059-0016FE50 Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00001188-35121-30-001D9C5D Assembly shows XOR instruction xor edi dword ptr [00219038h] in Stream UID: 00000000-00001188-35121-30-001D9C5D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-48-0015EAD8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-48-0015EAD8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-3800-00175D5A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-3800-00175D5A Assembly shows XOR instruction xor edi 756E6547h in Stream UID: 00000000-00001188-35121-603-0015C891 Assembly shows XOR instruction xor eax 49656E69h in Stream UID: 00000000-00001188-35121-603-0015C891 Assembly shows XOR instruction xor eax 6C65746Eh in Stream UID: 00000000-00001188-35121-603-0015C891 Assembly shows XOR instruction xor edi dword ptr [00219038h] in Stream UID: 00000000-00001188-35121-81-0015ECC7 Assembly shows XOR instruction xor eax dword ptr [edx] in Stream UID: 00000000-00001188-35121-81-0015ECC7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-401-0015C6CA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-401-0015C6CA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-179-001DD7B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-179-001DD7B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-180-001DD0FF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-180-001DD0FF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-1065-001E9A9B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-1065-001E9A9B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-3017-0015BBB7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-3017-0015BBB7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-128-0015EDFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-128-0015EDFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-4387-0017B17B Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00001188-35121-605-001955C1 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00001188-35121-605-001955C1 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00001188-35121-605-001955C1 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00001188-35121-605-001955C1 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00001188-35121-605-001955C1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-1074-0015AB22 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-1074-0015AB22 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-1064-001E9D82 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-1064-001E9D82 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-1655-001CEBCE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-1655-001CEBCE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-4019-00170ADE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-4019-00170ADE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-1278-001DE94C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-1278-001DE94C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-178-001DD8D9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-178-001DD8D9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-3014-00194524 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-3014-00194524 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-177-001DD6A5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-177-001DD6A5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-1165-0015AB9F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-1165-0015AB9F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-40-0015D7E6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-40-0015D7E6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001188-35121-131-001E5643 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001188-35121-131-001E56432a:T9ec,".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000009e291b7758e49a020000000028000000240000000000990230ee3d000000000000000000000000000000000000000000d0076e0230000000000000001500000000006e02f8c94773da003d007596467300000000d0e39a02b8ad990202000000000000002000000000006e02d0016e02ac0b6e0200000000a80b6e0214ee3d0028ee3d0050f51a7758e49a0290ee3d00dcee3d00 (UID: 00000000-00001188) ".exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001188) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001452) "AppLaunch.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000001b77000000000100000000ee3b00fc8676732a007d73fb8c1b770000000000000000fc867673d4ee3b000000000000000000000000002a007d7309000000a08b6e0009000000fc867673000000005005bc725a622b0073154673e8203b00abcb9d7150f23b00804446739e63575cfeffffff90ee3b00ea5e457340ee3b000540008000000000035f4573bcee3b0000000000000000000000000000000000000000000000000001000000000000000100000000000000b8ee3b0000000000c8ee3b0000000000bcee3b000000000000000000000000008700000042622b2fd4ee3b0084da037501000000099c650dd8ee3b00dab903750000b372ccee3b00 (UID: 00000000-00001452)2b:T2064,"AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000161b770c00000000000000281267040000680053a840731800000000000000000000000300000002000000000068000c0000000000000020000000d8ee3b00ee131b7728126704ee131b7700000000000000000c00000000707300f0ee3b002823977100006800000000000c000000f0217604fcee3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000000000000000000000006800000000001800000000000000000000000300000002000000000068000c000000000000001e95aad564ef3b00ee131b7700000000ee131b7700000000000000000c000000ffff466eec6f74007cef3b002823977100006800000000000c00000008325b6e88ef3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000161b770c00000000000000000000000000680080f03b001800000000000000000000000300000002000000000068000c0000000000000024f03b0028f03b00ee131b7700000000ee131b7700000000000000000c0000006b17826b40f03b002823977100006800000000000c00000030a55b6e4cf03b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 94000000060000000300000080250000020000000000000000000000281267040000680030ce76001800000000000000000000000300000002000000000068000c000000000000008b3c3f73dcee3b00ee131b7728126704ee131b7700000000000000000c00000030ce760030ce7600f4ee3b002823977100006800000000000c000000fc68760400ef3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000000000000000000000006800000000001800000000000000000000000300000002000000000068000c000000000000000e95aad574ef3b00ee131b7700000000ee131b7700000000000000000c000000ffff466eec6f74008cef3b002823977100006800000000000c00000008325b6e98ef3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000000000000000000000006800010000001800000000000000000000000300000002000000000068000c00000000000000feffffff2cf03b00ee131b7700000000ee131b7700000000000000000c0000006b17826b38f03b0044f03b002823977100006800000000000c00000030a55b6e50f03b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000000000002812670400006800c0b5b1071800000000000000000000000300000002000000000068000c000000000000008b3c3f73b4ee3b00ee131b7728126704ee131b7700000000000000000c000000c0b5b107c0b5b107ccee3b002823977100006800000000000c00000034839f04d8ee3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000161b770c000000000000000000000000006800100000001800000000000000000000000300000002000000000068000c000000000000003cef3b0028ef3b00ee131b7700000000ee131b7700000000000000000c000000ffff466e40ef3b002823977100006800000000000c00000008325b6e4cef3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000000000000000000000006800010000001800000000000000000000000300000002000000000068000c00000000000000feffffff04f03b00ee131b7700000000ee131b7700000000000000000c0000006b17826b10f03b001cf03b002823977100006800000000000c00000030a55b6e28f03b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000000000002812670400006800f804b3071800000000000000000000000300000002000000000068000c000000000000008b3c3f73acee3b00ee131b7728126704ee131b7700000000000000000c000000f804b307f804b307c4ee3b002823977100006800000000000c000000e0cea204d0ee3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000000000000000000000006800000000001800000000000000000000000300000002000000000068000c000000000000007e95aad544ef3b00ee131b7700000000ee131b7700000000000000000c000000ffff466eec6f74005cef3b002823977100006800000000000c00000008325b6e68ef3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000000000000000000000006800010000001800000000000000000000000300000002000000000068000c00000000000000fefffffffcef3b00ee131b7700000000ee131b7700000000000000000c0000006b17826b08f03b0014f03b002823977100006800000000000c00000030a55b6e20f03b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000161b770c00000000000000281267040000680053a840731800000000000000000000000300000002000000000068000c0000000000000020000000b0ee3b00ee131b7728126704ee131b7700000000000000000c000000d806b307c8ee3b002823977100006800000000000c0000005ceaa204d4ee3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000000000000000000000006800000000001800000000000000000000000300000002000000000068000c000000000000004695aad53cef3b00ee131b7700000000ee131b7700000000000000000c000000ffff466ed404b30754ef3b002823977100006800000000000c00000008325b6e60ef3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000161b770c00000000000000000000000000680058f03b001800000000000000000000000300000002000000000068000c00000000000000fcef3b0000f03b00ee131b7700000000ee131b7700000000000000000c0000006b17826b18f03b002823977100006800000000000c00000030a55b6e24f03b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000161b770c00000000000000281267040000680053a840731800000000000000000000000300000002000000000068000c000000000000002000000080ee3b00ee131b7728126704ee131b7700000000000000000c0000006803b30798ee3b002823977100006800000000000c000000d81b7c04a4ee3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000000000000000000000006800000000001800000000000000000000000300000002000000000068000c000000000000005695aad52cef3b00ee131b7700000000ee131b7700000000000000000c000000ffff466ed404b30744ef3b002823977100006800000000000c00000008325b6e50ef3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000000000000000000000006800010000001800000000000000000000000300000002000000000068000c00000000000000feffffffe4ef3b00ee131b7700000000ee131b7700000000000000000c0000006b17826bf0ef3b00fcef3b002823977100006800000000000c00000030a55b6e08f03b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000161b770c00000000000000281267040000680053a840731800000000000000000000000300000002000000000068000c000000000000002000000080ee3b00ee131b7728126704ee131b7700000000000000000c000000f007b30798ee3b002823977100006800000000000c0000008c2c7c04a4ee3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000161b770c000000000000000000000000006800200000001800000000000000000000000300000002000000000068000c000000000000003cef3b0028ef3b00ee131b7700000000ee131b7700000000000000000c000000ffff466e40ef3b002823977100006800000000000c00000008325b6e4cef3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000161b770c00000000000000281267040000680053a840731800000000000000000000000300000002000000000068000c000000000000002000000080ee3b00ee131b7728126704ee131b7700000000000000000c0000007807b30798ee3b002823977100006800000000000c000000443d7c04a4ee3b002f995b6e0c000000 (UID: 00000000-00001452) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000161b770c00000000000000281267040000680053a840731800000000000000000000000300000002000000000068000c000000000000002000000080ee3b00ee131b7728126704ee131b7700000000000000000c000000b803b30798ee3b002823977100006800000000000c00000054527c04a4ee3b002f995b6e0c000000 (UID: 00000000-00001452)2c:T66d,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp")2d:T477,GetLocaleInfoEx@KERNEL32.DLL at 00000000-00001188-35121-3024-001941AD GetLocaleInfoW@KERNEL32.DLL at 00000000-00001188-35121-401-0015C6CA GetLocaleInfoW@KERNEL32.DLL at 00000000-00001188-35121-1065-001E9A9B GetLocaleInfoW@KERNEL32.DLL at 00000000-00001188-35121-457-001E9EF1 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001188-35121-1064-001E9D82 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001188-35121-454-001E98AB EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001188-35121-4917-001D96EA EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001188-35121-458-001E992D GetLocaleInfoW@KERNEL32.DLL at 00000000-00001188-35121-1063-001EA038 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001188-35121-455-001E99EE GetLocaleInfoW@KERNEL32.DLL at 00000000-00001188-35121-425-0015D85E GetUserDefaultLCID@KERNEL32.DLL at 00000000-00001188-35121-453-0015E08D GetLocaleInfoEx@KERNEL32.DLL at 00000000-00001188-35121-3679-0017B83D GetUserDefaultLCID@KERNEL32.DLL at 00000000-00001188-35121-409-0015DCC3 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001188-35121-404-001D94F9 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00001188-35121-1067-001E99082e:T496,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")2f:T63a,"AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00001452-00000C15-59254958 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00001452-00000C15-60317661 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00001452-00000C15-60433995 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll" at 00000000-00001452-00000C15-60668093 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll" at 00000000-00001452-00000C15-61353929 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00001452-00000C15-62150397 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00001452-00000C15-63703308 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00001452-00000C15-6375880630:T7bf,"AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYVERSION")31:T13fc,".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001188) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001188) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001188) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001188) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001188) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001188) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001188) ".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001188) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\aspnet_rc.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\aspnet_rc.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_rc.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\webengine4.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\webengine4.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter webengine4.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\crypt32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00001452) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00001452)32:T6e15,".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001188) ".exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00001188) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GdipGetImageGraphicsContext (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GdipSetInterpolationMode (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GdipSetPixelOffsetMode (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GdipSetSmoothingMode (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeLibrary (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost_RetAddr (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter PerfCounterInitialize (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter MgdGetIISVersionInformation (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDirMonConfiguration (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter ZeroMemory (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter ZeroMemoryA (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptUnprotectDataW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptImportKey (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00001452) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001452)33:T9a30,Found reference to API (Indicator: "FreeConsole"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "VirtualProtect"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "FlsAlloc"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "FlsFree"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "FlsGetValue"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "FlsSetValue"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CreateEventExW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CreateSemaphoreW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CreateSemaphoreExW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CreateThreadpoolWait"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "SetThreadpoolWait"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CloseThreadpoolWait"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "FlushProcessWriteBuffers"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetCurrentProcessorNumber"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetTickCount64"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "InitializeConditionVariable"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "WakeConditionVariable"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "InitializeSRWLock"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CreateThreadpoolWork"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "SubmitThreadpoolWork"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CloseThreadpoolWork"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CompareStringEx"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "LCMapStringEx"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "AreFileApisANSI"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetActiveWindow"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetDateFormatEx"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetEnabledXStateFeatures"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetLastActivePopup"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetProcessWindowStation"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetTimeFormatEx"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetXStateFeaturesMask"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "IsValidLocaleName"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "LCIDToLocaleName"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "LocaleNameToLCID"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "LocateXStateFeature"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "MessageBoxA"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "MessageBoxW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "Sleep"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CloseHandle"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "SwitchToThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetExitCodeThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "FormatMessageA"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "LocalFree"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "EncodePointer"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "DecodePointer"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetProcAddress"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetCPInfo"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "InitializeSListHead"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "TerminateProcess"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "RaiseException"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "RtlUnwind"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "InterlockedFlushSList"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetLastError"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "SetLastError"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "TlsAlloc"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "TlsGetValue"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "TlsSetValue"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "TlsFree"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "FreeLibrary"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CreateThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "ExitThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "ResumeThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetModuleHandleExW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetStdHandle"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "WriteFile"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "ExitProcess"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetCommandLineA"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetCurrentThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "HeapAlloc"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "HeapFree"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetFileType"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetDateFormatW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetTimeFormatW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CompareStringW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "LCMapStringW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetLocaleInfoW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "IsValidLocale"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "ReadFile"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetFileSizeEx"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "SetFilePointerEx"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "ReadConsoleW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "OutputDebugStringW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "FindClose"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "FindFirstFileExW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "FindNextFileW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "IsValidCodePage"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetACP"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetOEMCP"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "SetStdHandle"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "HeapSize"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "CreateFileW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API (Indicator: "GetTempFileName"; File: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; File: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; File: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; File: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; File: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "GetEnabledXStateFeatures"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "GetXStateFeaturesMask"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "LocateXStateFeature"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp, 00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp, 00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp, 00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp, 00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API (Indicator: "UnregisterApplicationRestart"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocExNuma"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API (Indicator: "VerifyConsoleIoHandle"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API (Indicator: "SetThreadPriorityBoost"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API (Indicator: "VDMOperationStarted"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API (Indicator: "SetThreadPreferredUILanguages"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API (Indicator: "SignalObjectAndWait"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00001188.00000000.68690.7F870000.00000002.mdmp")34:T628,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp")35:T830,"%APPDATA%\Opera Software\*" in Source: 00000000-00001452-00000C28-15076814095 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00001452-00000C28-15139756085 "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001188.00000000.68690.00220000.00000004.mdmp "Software\Valve\SteamLogin Data" in Source: 00000000-00001188.00000000.68690.00220000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Micro" in Source: 00000000-00001188.00000000.68690.002D8000.00000004.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug" in Source: 00000000-00001188.00000000.68690.027C0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00001188.00000000.68690.7F870000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00001188.00000000.68690.7F870000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00001188.00000000.68690.7F870000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00001188.00000000.68690.7F870000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00001188.00000000.68690.7F870000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00001188.00000000.68690.7F870000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00001188.00000000.68690.7F870000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00001188.00000000.68690.7F870000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00001188.00000000.68690.7F870000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00001188.00000000.68690.7F870000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00001188.00000000.68690.7F870000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00001188.00000000.68690.7F870000.00000002.mdmp36:T481,"AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\crypt32.dll" - [base:0; Status:c0000135]37:T1250,".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f50000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f50000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f50000 ".exe" loaded module "KERNEL32" at base 74e80000 ".exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733f0000 ".exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74f50000 ".exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74f50000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74f50000 ".exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74350000 ".exe" loaded module "NTDLL.DLL" at base 77170000 ".exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 74e80000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f50000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f50000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f50000 "AppLaunch.exe" loaded module "KERNEL32" at base 74e80000 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 733f0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6e5b0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 74f50000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6e590000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6e510000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6e500000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6e440000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 74f50000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 74f50000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "OLEAUT32.DLL" at base 74250000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 75e00000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "AppLaunch.exe" loaded module "SECUR32.DLL" at base 6e430000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 73fc0000 "AppLaunch.exe" loaded module "USER32.DLL" at base 75c80000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73510000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f9c0000 "AppLaunch.exe" loaded module "GDIPLUS.DLL" at base 73760000 "AppLaunch.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73760000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 77140000 "AppLaunch.exe" loaded module "WINDOWSCODECS.DLL" at base 72b30000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 77170000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 73e50000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WEBENGINE4.DLL" at base 6e3a0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WEBENGINE4.DLL" at base 6e3a0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.WEB\V4.0_4.0.0.0__B03F5F7F11D50A3A\WEBENGINE4.DLL" at base 0 "AppLaunch.exe" loaded module "WEBENGINE4.DLL" at base 6e3a0000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 74070000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 75510000 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 72200000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 74e80000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.SECURITY\V4.0_4.0.0.0__B03F5F7F11D50A3A\CRYPT32.DLL" at base 0 "AppLaunch.exe" loaded module "CRYPT32.DLL" at base 75130000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 72290000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6e25000038:T46a,"AppLaunch.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "AppLaunch.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "AppLaunch.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "AppLaunch.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "AppLaunch.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "AppLaunch.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "AppLaunch.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")39:Ted9,Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"3,"System.Runtime.Serialization Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00001452-00000C25-59347675] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001452-00000C25-59652108] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001452-00000C25-59874855] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001452-00000C25-59956944] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00001452-00000C25-60033208] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00001452-00000C25-60569231] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00001452-00000C25-62180171] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\aspnet_rc.dll" [Source: 00000000-00001452-00000C25-63949256] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\aspnet_rc.dll" [Source: 00000000-00001452-00000C25-63976753] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_rc.dll" [Source: 00000000-00001452-00000C25-64053976] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\webengine4.dll" [Source: 00000000-00001452-00000C25-64079257] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\\webengine4.dll" [Source: 00000000-00001452-00000C25-64103685] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll" [Source: 00000000-00001452-00000C25-64129899] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\crypt32.dll" [Source: 00000000-00001452-00000C25-64432232] Observed system executable string:"%WINDIR%\system32\bcrypt.dll" [Source: 00000000-00001452-00000C25-64754942] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" [Source: 00000000-00001452-00000C25-88009645]3a:T5ad,".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")3b:Ta80,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "NA_8D5A14BE495DA026ED5C5AD37.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")3c:T441,"AppLaunch.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe.config" "AppLaunch.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "AppLaunch.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "AppLaunch.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "AppLaunch.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.runteb92aa12#\274e43040c8a7a02ef1065db3283005a\system.runtime.serialization.ni.dll.aux" "AppLaunch.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux" "AppLaunch.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "AppLaunch.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux"3d:T9b7,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CRYPTSP.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\BCRYPT.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\WS2_32.DLL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FLTLIB.DLL" "AppLaunch.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "AppLaunch.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\WBEMCOMN.DLL" "AppLaunch.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll"3e:T9ae,"AppLaunch.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "AppLaunch.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\APPLAUNCH.EXE.LOG" "AppLaunch.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\KNAPPLES" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\APPLAUNCH.INI" "AppLaunch.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "AppLaunch.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.SERVICEMODEL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.SERVICEMODEL.INI" "AppLaunch.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDIAGNOSTICS" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDIAGNOSTICS.INI" "AppLaunch.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.IDENTITYMODEL" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.IDENTITYMODEL.INI" "AppLaunch.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.SERVD1DEC626#" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\SYSTEM.SERVICEMODEL.INTERNALS.INI" "AppLaunch.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.TRANSACTIONS" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.INI" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "AppLaunch.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.MANAGEMENT.INI"3f:T679,"AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\* (UID: 00000000-00001452) "AppLaunch.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001452) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\* (UID: 00000000-00001452) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\* (UID: 00000000-00001452) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\* (UID: 00000000-00001452) "AppLaunch.exe" called "FindFirstFileW" with parameter %APPDATA%\* (UID: 00000000-00001452) "AppLaunch.exe" called "FindNextFileW" with parameter Adobe (UID: 00000000-00001452) "AppLaunch.exe" called "FindNextFileW" with parameter Macromedia (UID: 00000000-00001452) "AppLaunch.exe" called "FindNextFileW" with parameter Microsoft (UID: 00000000-00001452) "AppLaunch.exe" called "FindNextFileW" with parameter Mozilla (UID: 00000000-00001452) "AppLaunch.exe" called "FindNextFileW" with parameter Sun (UID: 00000000-00001452) "AppLaunch.exe" called "FindNextFileW" with parameter Wireshark (UID: 00000000-00001452) "AppLaunch.exe" called "FindFirstFileW" with parameter %APPDATA%\Adobe\* (UID: 00000000-00001452) "AppLaunch.exe" called "FindNextFileW" with parameter Acrobat (UID: 00000000-00001452) "AppLaunch.exe" called "FindNextFileW" with parameter Flash Player (UID: 00000000-00001452) "AppLaunch.exe" called "FindNextFileW" with parameter Headlights (UID: 00000000-00001452)40:T5f3,Found string "FromBase64" (Indicator: "base64"; File: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; File: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found string "AEs`" (Indicator: "aes"; Source: "00000000-00001188.00000000.68690.02930000.00000004.mdmp") Found string "wPaEs" (Indicator: "aes"; Source: "00000000-00001188.00000000.68690.02930000.00000004.mdmp")41:T65d,Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001188.00000000.68690.02990000.00000004.mdmp")42:T7da,Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "NA_8d5a14be495da026ed5c5ad37.bin") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp, 00000000-00001188.00000000.68690.00220000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001188.00000000.68690.0021E000.00000002.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00001188.00000000.68690.00220000.00000004.mdmp")43:Ta08,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")44:Tab2,"AppLaunch.exe" wrote bytes "c0026f7560066f75" to virtual address "0x754D004C" (part of module "COMBASE.DLL") "AppLaunch.exe" wrote bytes "00413b75003d3b75608a3375b0ff357500913375b0073975e0b6357550b63575b0f0347500923b7550bc3575b0ff387590413b7570b7357510c73b7580043575" to virtual address "0x757A9058" (part of module "CLBCATQ.DLL") "AppLaunch.exe" wrote bytes "00894674" to virtual address "0x7715E010" (part of module "GDI32.DLL") "AppLaunch.exe" wrote bytes "0017366e6019366e" to virtual address "0x75224084" (part of module "CRYPT32.DLL") "AppLaunch.exe" wrote bytes "e0a7267420a926742035267410a3267420362674c0372674d0352674403526749076267480a0267460902674f08c26741092267460362674408b267400592b74f037267470a82674f08a2774008b2774" to virtual address "0x6E4F2008" (part of module "FASTPROX.DLL") "AppLaunch.exe" wrote bytes "70f03a75b0ff3575b0f0347580043575f08c3c7500163c75b0073975a0f93a75909733750091337560f83a75" to virtual address "0x72C8B040" (part of module "WINDOWSCODECS.DLL") "AppLaunch.exe" wrote bytes "203d267430892674b0d32a7420762774d0d32a74008826745037267490d32a74203526746036267480a0267410a3267410922674" to virtual address "0x72C8B000" (part of module "WINDOWSCODECS.DLL") "AppLaunch.exe" wrote bytes "d0d0747590d17475" to virtual address "0x754D00C4" (part of module "COMBASE.DLL") "AppLaunch.exe" wrote bytes "d0e44674c0e44674a0dc467420b1467490af4674f0564674e0864a7420c7467440ec467420ee4674" to virtual address "0x7715E958" (part of module "GDI32.DLL") "AppLaunch.exe" wrote bytes "203d26743089267460412674d0782674407b267400882674607c267450372674" to virtual address "0x6E50C000" (part of module "WBEMSVC.DLL") "AppLaunch.exe" wrote bytes "70ebc97500ecc97540ecc975" to virtual address "0x754D01FC" (part of module "COMBASE.DLL") "AppLaunch.exe" wrote bytes "20a926742035267470a82674e0a7267410a32674" to virtual address "0x6E51A000" (part of module "WBEMPROX.DLL") "AppLaunch.exe" wrote bytes "907c4674002b46740039467470a24674b0af4674708c437450744374d0d0487460af467480804674b0844674f05f467430a34674" to virtual address "0x7715E060" (part of module "GDI32.DLL") "AppLaunch.exe" wrote bytes "e02afb73702afb73" to virtual address "0x6E365000" (part of module "DPAPI.DLL") "AppLaunch.exe" wrote bytes "c0dafc73c0dbfc73d07afd73" to virtual address "0x755810C0" (part of module "ADVAPI32.DLL") "AppLaunch.exe" wrote bytes "10a32674e0a7267480a02674f08a277460692674f057267420a92674008b277470a82674" to virtual address "0x754D0014" (part of module "COMBASE.DLL") "AppLaunch.exe" wrote bytes "500738758004357500913375" to virtual address "0x6E5A9000" (part of module "WMIUTILS.DLL") "AppLaunch.exe" wrote bytes "b0f8a3756058a17520eca375304ea47520f4a375" to virtual address "0x6E36500C" (part of module "DPAPI.DLL")45:T179f,"AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ELEMENTS BROWSER\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCOZMEDIA\URAN\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\LIEBAO\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAXTHON3\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\K-MELON\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\URAN\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMODO\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAIL.RU\ATOM\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CRYPTOTAB BROWSER\USER DATA" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\ODBFPEEIHDKBIHMOPKBJMOONFANLBFCL" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FHILAHEIMGLIGNDDKJGOFKCBGEKHENBH" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ" "AppLaunch.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG"46:T1b3e,AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB related to Yoroi AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID related to Nifty Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD related to Coinbase Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC related to EQUA Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE related to Jaxx Liberty AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ related to iWallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH related to Wombat AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM related to MEW CX AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ related to GuildWallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG related to Saturn Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FNJHMKHHMKBJKKABNDCNNOGAGOGBNEEC related to Ronin Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AIIFBNBFOBPMEEKIPHEEIJIMDPNLPGPP related to Terra Station AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet AppLaunch.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KPFOPKELMAPCOIPEMFENDMDCGHNEGIMN related to Liquality Wallet AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB related to Yoroi AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID related to Nifty Wallet AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN related to MetaMask AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD related to Coinbase Wallet AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\BLNIEIIFFBOILLKNJNEPOGJHKGNOAPAC related to EQUA Wallet AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE related to Jaxx Liberty AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ related to iWallet AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH related to Wombat AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM related to MEW CX AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ related to GuildWallet AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG related to Saturn Wallet AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\FNJHMKHHMKBJKKABNDCNNOGAGOGBNEEC related to Ronin Wallet AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AIIFBNBFOBPMEEKIPHEEIJIMDPNLPGPP related to Terra Station AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet AppLaunch.exe trying to open a file %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Extension Settings\KPFOPKELMAPCOIPEMFENDMDCGHNEGIMN related to Liquality Wallet1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"8d5a14be495da026ed5c5ad37667faf349317ad31f5928de4e353db0e99031ab","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790608699418,"unified_at":"2026-09-28T15:18:19.418Z","metadata":{"hashes":{"sha256":"8d5a14be495da026ed5c5ad37667faf349317ad31f5928de4e353db0e99031ab","sha1":"cd10b16c9b713e9096867cdc418c2ed69fc1fc32","md5":"a5614da146b46ebca0589e7790082341","sha512":"2d95bbeb0223b6652ce8e3a8fba992c5ef1ef8405591b63b12a86f794dcfd7e7e2b58798a23066a4e7a8303a0e9d713c66b04b573f3935bbd8f1032eef881978","ssdeep":"24576:/UVglkQczvB2EhwWLFXW4SH77tYDuu2oEFgU:mQczvB2EeKB877mDuu2+U","ssdeep_chunks":["24576:/UVglkQ","24576:UVglkQc","24576:VglkQcz","24576:glkQczv","24576:lkQczvB","24576:kQczvB2","24576:QczvB2E","24576:czvB2Eh","24576:zvB2Ehw","24576:vB2EhwW","24576:B2EhwWL","24576:2EhwWLF","24576:EhwWLFX","24576:hwWLFXW","24576:wWLFXW4","24576:WLFXW4S","24576:LFXW4SH","24576:FXW4SH7","24576:XW4SH77","24576:W4SH77t","24576:4SH77tY","24576:SH77tYD","24576:H77tYDu","24576:77tYDuu","24576:7tYDuu2","24576:tYDuu2o","24576:YDuu2oE","24576:Duu2oEF","24576:uu2oEFg","24576:u2oEFgU","49152:/UVglkQ","49152:UVglkQc","49152:VglkQcz","49152:glkQczv","49152:lkQczvB","49152:kQczvB2","49152:QczvB2E","49152:czvB2Eh","49152:zvB2Ehw","49152:vB2EhwW","49152:B2EhwWL","49152:2EhwWLF","49152:EhwWLFX","49152:hwWLFXW","49152:wWLFXW4","49152:WLFXW4S","49152:LFXW4SH","49152:FXW4SH7","49152:XW4SH77","49152:W4SH77t","49152:4SH77tY","49152:SH77tYD","49152:H77tYDu","49152:77tYDuu","49152:7tYDuu2","49152:tYDuu2o","49152:YDuu2oE","49152:Duu2oEF","49152:uu2oEFg","49152:u2oEFgU","24576:mQczvB2","24576:czvB2Ee","24576:zvB2EeK","24576:vB2EeKB","24576:B2EeKB8","24576:2EeKB87","24576:EeKB877","24576:eKB877m","24576:KB877mD","24576:B877mDu","24576:877mDuu","24576:77mDuu2","24576:7mDuu2+","24576:mDuu2+U"],"imphash":"804a3a181935154bc979712eeaeaaa91"},"file_info":{"file_name":"NA_8d5a14be495da026ed5c5ad37.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":977408,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1690373415000,"last_seen":1690373415000,"last_multi_scan":1690373415000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["backdoor","commodity","informationstealer","redlinestealer"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":54},"sandbox_signatures":{"informative_count":128,"suspicious_count":14,"malicious_count":11,"total":153},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HUBU trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.GTY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to modify processes thread functionality"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Persistence","technique":"AppInit DLLs","attack_id":"T1546.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/010","identifiers":[{"type":"informative","value":"Contains ability to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-size sections"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Dotnet file packed with confuser protection"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"suspicious","value":"Looks up many procedures within the same disassembly stream (often used to hide usage)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"malicious","value":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"suspicious","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal crypto wallet extension (file access)"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"malicious","value":"Tries to steal desktop applications information (file access)"},{"type":"informative","value":"Queries list of installed browsers"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00001188.00000000.68690.02990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001188.00000000.68690.02990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")\n Found reference to \"CryptographicException\" (Indicator: \"CryptographicException\"; File: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")\n Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; File: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")\n Found reference to \"CryptographicException\" (Indicator: \"CryptographicException\"; Source: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")\n Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file packed with confuser protection","description":"Observed string: \"ConfusedByAttribute\" (Indicator: \"ConfusedByAttribute\") in Source: 00000000-00001188.00000000.68690.00220000.00000004.mdmp\n Observed string: \"Confuser.Core 1.6.0+447341964f\" (Indicator: \"Confuser.Core \") in Source: 00000000-00001188.00000000.68690.00220000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1027.002","relevance":1,"id":"string-232","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001188.00000000.68690.00110000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001188-35121-48-0015EAD8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001188-35121-2965-00195921\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001188-35121-2-0015CB43\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001188-35121-44-0015F866","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API FlsAlloc@KERNEL32.DLL at 00000000-00001188-35121-3679-0017B83D","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".textbss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"AppLaunch.exe\" called \"IsWow64Process\" with parameter \"1452\" - (UID: 00000000-00001452)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"AppLaunch.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001452)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount64@KERNEL32.DLL at 00000000-00001188-35121-3676-0017BD41\n GetTickCount64@KERNEL32.DLL at 00000000-00001188-35121-3679-0017B83D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.DLL at 00000000-00001188-35121-40-0015D7E6\n FindFirstFileExW@KERNEL32.DLL at 00000000-00001188-35121-41-001E485A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001188.00000000.68690.001FF000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001188-35121-1358-001DA28C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001188-35121-605-001955C1\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001188-35121-3783-0015B379","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001188-35121-1358-001DA28C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001188-35121-605-001955C1\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001188-35121-3783-0015B379\n GetSystemTimePreciseAsFileTime@KERNEL32.DLL at 00000000-00001188-35121-3679-0017B83D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00001188-35121-1192-001E2FD1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00001188.00000000.68690.001FF000.00000002.mdmp\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001188.00000000.68690.001FF000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00001188.00000000.68690.001FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; File: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")\n Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00001188.00000000.68690.02990000.00000004.mdmp\")\n Found reference to API \"8407971789,1468,3024,,RtlGetVersion,NTDLL.dll,\"00:17:52.015\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00001188.00000000.68690.02990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 001E30FDh\" at 00000000-00001188-35121-1192-001E2FD1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"AppLaunch.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$30","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 4, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Microsoft Connection Test\" (SID: 2031071, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"NA_8d5a14be495da026ed5c5ad37.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"AppLaunch.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\ElevatedDiagnostics\\Reports (UID: 00000000-00001452)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" - (UID: 00000000-00001188)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"176.123.9.85:16482\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\A10\\wcyudp08p\\output.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"SleepConditionVariableSRW at 00000000-00001188-35121-4413-0017BE3F\n Sleep@KERNEL32.DLL at 00000000-00001188-35121-2961-00196155\n SleepConditionVariableCS at 00000000-00001188-35121-3791-00176302\n SleepConditionVariableSRW at 00000000-00001188-35121-3790-0017632A\n Sleep@KERNEL32.DLL at 00000000-00001188-35121-4078-0016F6E0\n SleepConditionVariableCS at 00000000-00001188-35121-4412-0017BE26\n Sleep@KERNEL32.DLL at 00000000-00001188-35121-4019-00170ADE\n SleepConditionVariableCS at 00000000-00001188-35121-4370-001762B4\n TpSetTimer at 00000000-00001188-35121-4410-0017BDF1\n WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00001188-35121-347-0015C062","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00001188-35121-32-001D9B65\n LoadLibraryExW@KERNEL32.DLL at 00000000-00001188-35121-156-001A645E\n LoadLibraryExW@KERNEL32.DLL at 00000000-00001188-35121-1366-001D9D93","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 485635)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:1452:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"NA_8d5a14be495da026ed5c5ad37.bin\" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"AppLaunch.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70500000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 742F0000\n \"AppLaunch.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 742F0000\n \"AppLaunch.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72290000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"AppLaunch.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 719C0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75A10000\n \"AppLaunch.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75A10000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"NA_8d5a14be495da026ed5c5ad37.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$38","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"NA_8d5a14be495da026ed5c5ad37.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"NA_8d5a14be495da026ed5c5ad37.bin\" has an executable section named \".textbss\"\n \"NA_8d5a14be495da026ed5c5ad37.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"NA_8d5a14be495da026ed5c5ad37.bin\" has an writable section named \".textbss\"\n \"NA_8d5a14be495da026ed5c5ad37.bin\" has an writable section named \".data\"\n \"NA_8d5a14be495da026ed5c5ad37.bin\" has an writable section named \".teext\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"NA_8d5a14be495da026ed5c5ad37.bin\" file has an entrypoint instructions - \"jmp\t0x484c01,jmp\t0x49b3c8,jmp\t0x48d290,jmp\t0x4862d5,jmp\t0x479106,jmp\t0x46ada2,jmp\t0x4dde60,jmp\t0x4796ae,jmp\t0x49b78b,jmp\t0x4661f3,jmp\t0x4e40b0,jmp\t0x46584c,jmp\t0x485b18,jmp\t0x464484,jmp\t0x495d24,jmp\t0x46f7df,jmp\t0x4af779,jmp\t0x467104,jmp\t0x4634ad,jmp\t0x4cb098,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"AppLaunch.exe\" (UID: 00000000-00001452) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"AppLaunch.exe\" (UID: 00000000-00001452) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"AppLaunch.exe\" (UID: 00000000-00001452)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 452 -p 1188 -ip 1188\" (UID: 00000000-00001736)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1188 -s 396\" (UID: 00000000-00001744)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1188 -s 396\" (UID: 00000000-00001820)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"AppLaunch.exe\" (UID: 00000000-00001452)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 452 -p 1188 -ip 1188\" (UID: 00000000-00001736)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1188 -s 396\" (UID: 00000000-00001744)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1188 -s 396\" (UID: 00000000-00001820)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"NA_8d5a14be495da026ed5c5ad37.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"AppLaunch.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"AppLaunch.exe.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\AppLaunch.exe.log]- [targetUID: 00000000-00001452]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\".exe\" queries basic process information of the \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" (UID: 1188)\n \".exe\" queries basic process information of the \"C:\\NA_8d5a14be495da026ed5c5ad37.exe\" (UID: 1188)\n \"AppLaunch.exe\" queries basic process information of the \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" (UID: 1452)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"AppLaunch.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001452)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\".exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \".exe\" trying to touch file \"C:\\NA_8d5a14be495da026ed5c5ad37.exe\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\win32u.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msvcp_win.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\gdi32full.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\gdi32.dll\"\n \".exe\" trying to touch file \"C:\\Windows\\SysWOW64\\user32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"AppLaunch.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\applaunch.exe.log\"\n \"AppLaunch.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0_32\\usagelogs\\applaunch.exe.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"AppLaunch.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\AppLaunch.exe.log\"\n \"AppLaunch.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\AppLaunch.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"V^G.Tp\"\n Heuristic match: \"leStream.IO\"\n Pattern match: \"api.ip.sb/ip\"\n Heuristic match: \"ileStream.IO\"\n Pattern match: \"http://www.w3.org/2001/XMLSchema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"AppLaunch.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1577126211\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"AppLaunch.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"419497920\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"AppLaunch.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"AppLaunch.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"AppLaunch.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"AppLaunch.exe\" called \"GetUserNameW\" (UID: 00000000-00001452)\n \"AppLaunch.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"AppLaunch.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"6f5180\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$40","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp, 00000000-00001188.00000000.68690.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp, 00000000-00001188.00000000.68690.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; File: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")\n Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"8407971789,1468,3024,,RtlGetVersion,NTDLL.dll,\"00:17:52.015\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001188.00000000.68690.02990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001188.00000000.68690.001FF000.00000002.mdmp, 00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00001188.00000000.68690.001FF000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00001188.00000000.68690.001FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00001188.00000000.68690.00220000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%APPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00001452-00000C28-14519975283\")\n \"%APPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00001452-00000C28-14551590058\")\n \"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00001452-00000C28-14656668875\")\n \"%LOCALAPPDATA%\\Microsoft\\Vault\\*\" (Indicator: \"\\microsoft\\vault\"; File: \"00000000-00001452-00000C28-14702930987\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: NA_8d5a14be495da026ed5c5ad37.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"AppLaunch.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"AppLaunch.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001452)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\NA_8d5a14be495da026ed5c5ad37.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001188.00000000.68690.002D8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00001188.00000000.68690.02990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001188.00000000.68690.001FF000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"NA_8d5a14be495da026ed5c5ad37.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001188.00000000.68690.0021E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"AppLaunch.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\AppLaunch.exe.log]- [targetUID: 00000000-00001452]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"NA_8d5a14be495da026ed5c5ad37.bin\" was detected as \"Microsoft visual C++ 8.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"AppLaunch.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"AppLaunch.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 1452)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 40 calls to GetProcAddress@KERNEL32.DLL at 00000000-00001188-35121-3679-0017B83D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.007","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".00cfg with unusual entropies 0.110557131259","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\".exe queries ProcessDebugPort (UID: 1188)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00001188-35121-603-0015C891","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleExW@KERNEL32.DLL at 00000000-00001188-35121-69-001D05CC\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001188-35121-80-001D054F\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00001188-35121-253-001BCCB9\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001188-35121-206-0015E96B\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001188-35121-3679-0017B83D\n GetModuleHandleW@KERNEL32.DLL at 00000000-00001188-35121-5079-0015BB28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetNativeSystemInfo@KERNEL32.DLL at 00000000-00001188-35121-4302-00170A5E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00001188-35121-2967-0019588A\n GetStartupInfoW@KERNEL32.DLL at 00000000-00001188-35121-1400-001D9270","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"50/70 Antivirus vendors marked sample as malicious (71% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"suspicious","category":"General","name":"Contains ability to modify processes thread functionality","description":"ResumeThread@KERNEL32.DLL at 00000000-00001188-35121-1979-001BCD8D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-129","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"32.23.2.0\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@KERNEL32.DLL at 00000000-00001188-35121-47-0015C6C5\n TerminateProcess@KERNEL32.DLL at 00000000-00001188-35121-68-001D0477\n TerminateProcess@KERNEL32.DLL at 00000000-00001188-35121-44-0015F866","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"UnhandledExceptionFilter\n WriteFile\n OutputDebugStringW\n CreateThreadpoolWait\n GetModuleFileNameW\n IsDebuggerPresent\n LoadLibraryExW\n CreateThread\n ExitThread\n TerminateProcess\n GetModuleHandleExW\n CreateThreadpoolWork\n GetStartupInfoW\n SleepConditionVariableCS\n GetFileSizeEx\n FindNextFileW\n FindFirstFileExW\n GetProcAddress\n CreateFileW\n GetNativeSystemInfo\n GetCommandLineW\n SleepConditionVariableSRW\n GetCommandLineA\n GetTickCount64\n CreateThreadpoolTimer\n GetModuleHandleW\n Sleep","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$44","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" - (UID: 00000000-00001188)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"50/70 Antivirus vendors marked sample as malicious (71% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 4 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" (Handle: 388)\n \".exe\" wrote 155648 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" (Handle: 388)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"ps://api.ip.sb/ip\" (Indicator: \"api.ip.sb\"; File: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")\n \"ttps://api.ip.sb/ip\" (Indicator: \"api.ip.sb\"; File: \"00000000-00001188.00000000.68690.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 176.123.9.85 on port 16482","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"\"}\\FileZilla\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 00000000-00001188.00000000.68690.00220000.00000004.mdmp\n \"FileZilla\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: 00000000-00001188.00000000.68690.00220000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"AppLaunch.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\COINOMI\\COINOMI\\WALLETS\"\n \"AppLaunch.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ELECTRUM\\WALLETS\"\n \"AppLaunch.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\ETHEREUM\\WALLETS\"\n \"AppLaunch.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\EXODUS\\EXODUS.WALLET\"\n \"AppLaunch.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\Documents\\MONERO\\WALLETS\"\n \"AppLaunch.exe\" trying to touch file \"%LOCALAPPDATA%\\COINOMI\\COINOMI\\WALLETS\"\n \"AppLaunch.exe\" trying to touch file \"%APPDATA%\\ELECTRUM\\WALLETS\"\n \"AppLaunch.exe\" trying to touch file \"%APPDATA%\\ETHEREUM\\WALLETS\"\n \"AppLaunch.exe\" trying to touch file \"%APPDATA%\\EXODUS\\EXODUS.WALLET\"\n \"AppLaunch.exe\" trying to touch file \"%USERPROFILE%\\Documents\\MONERO\\WALLETS\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$45","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$46","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal desktop applications information (file access)","description":"\"AppLaunch.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00000000-00001188)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00001452)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 452 -p 1188 -ip 1188\" (UID: 00000000-00001736)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1188 -s 396\" (UID: 00000000-00001744)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1188 -s 396\" (UID: 00000000-00001820)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Tries to steal desktop applications information (file access)"},{"detail":"Found desktop apps credentials related location strings"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":84,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["backdoor","commodity","informationstealer","redlinestealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"64c27ea6aa1c1c074a0c984f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["MDA"],"submit_name":"NA_8d5a14be495da026ed5c5ad37.exe","analysis_start_time":"2023-07-27T14:26:46+00:00","indicators_count":{"informative":128,"suspicious":41,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"176.123.9.85","port":16482,"protocol":"TCP","country":"Moldova Republic of","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}],"processes":[{"pid":1188,"ppid":0,"name":"NA_8d5a14be495da026ed5c5ad37.exe","command_line":"","sha256":"8d5a14be495da026ed5c5ad37667faf349317ad31f5928de4e353db0e99031ab","normalized_path":"C:\\NA_8d5a14be495da026ed5c5ad37.exe","uid":"00000000-00001188","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":1452,"ppid":1188,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00001188","uid":"00000000-00001452"},{"pid":1744,"ppid":1188,"name":"WerFault.exe","command_line":"-u -p 1188 -s 396","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001188","uid":"00000000-00001744"},{"pid":1820,"ppid":1188,"name":"WerFault.exe","command_line":"-u -p 1188 -s 396","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001188","uid":"00000000-00001820"},{"pid":1736,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 452 -p 1188 -ip 1188","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001736","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["kernel32.dll","System.Xml.ni.dll","System.Management.dll","uxtheme.dll","webengine4.dll","user32.dll","version.dll","psapi.dll","clrjit.dll","System.ServiceModel.Internals.dll","SHCore.dll","powrprof.dll","WMINet_Utils.dll","profapi.dll","win32u.dll","gdi32full.dll","fltLib.dll","mscorlib.ni.dll","cryptsp.dll","bcrypt.dll","msctf.dll","sspicli.dll","clr.dll","System.ServiceModel.dll","System.Configuration.ni.dll","System.Transactions.dll","System.Windows.Forms.dll","System.Web.Extensions.dll","crypt32.dll","KernelBase.dll","sechost.dll","advapi32.dll","wbemprox.dll","GdiPlus.dll","rpcrt4.dll","VxSSL32.dll","ws2_32.dll","vcruntime140_clr0400.dll","cfgmgr32.dll","wbemsvc.dll","System.Drawing.dll","msasn1.dll","apphelp.dll","shlwapi.dll","ucrtbase_clr0400.dll","shell32.dll","wbemcomn.dll","secur32.dll","imm32.dll","combase.dll","System.Web.dll","msvcp_win.dll","mscoree.dll","windows.storage.dll","System.Dynamic.dll","ntdll.dll","gdi32.dll","msvcrt.dll","mscoreei.dll","System.IdentityModel.dll","System.Core.ni.dll","dpapi.dll","cryptbase.dll","System.ni.dll","SMDiagnostics.dll","rsaenh.dll","fastprox.dll","wow64cpu.dll","oleaut32.dll","Microsoft.CSharp.dll","userenv.dll","wmiutils.dll","System.Security.dll","diasymreader.dll","ucrtbase.dll","ole32.dll","WindowsCodecs.dll","wow64.dll","kernel.appcore.dll","System.Runtime.Serialization.ni.dll","mswsock.dll","wow64win.dll","bcryptprimitives.dll","clbcatq.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AppLaunch.exe.log","sha256":"e0670067e6dc2a3a9e6a5f26ef5e824b32d9b7b821fc8d6c64c0c2818f191fe9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\AppLaunch.exe.log","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:1452:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64c27ea6aa1c1c074a0c984f"}]}]}},"report_ids":{"sandbox_job_ids":["64c27ea6aa1c1c074a0c984f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample 8d5a14be495d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8d5a14be495d…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 3/27 AV engines flagged this file. 11 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8d5a14be495da026ed5c5ad37667faf349317ad31f5928de4e353db0e99031ab"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample 8d5a14be495d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8d5a14be495d…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 3/27 AV engines flagged this file. 11 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8d5a14be495da026ed5c5ad37667faf349317ad31f5928de4e353db0e99031ab"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample 8d5a14be495d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8d5a14be495d…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 3/27 AV engines flagged this file. 11 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L47","11",{}]]