26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T44b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean Sample 8dd2d00251e4… — Score 0/100 — Hybrid Analysis","description":"Clean verdict for sample 8dd2d00251e4…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5","keywords":["Clean","malware analysis","sandbox report","threat intelligence","8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5"],"about":{"@type":"SoftwareApplication","name":"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5","applicationCategory":["peexe","assembly","executable"],"identifier":"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5","additionalType":"Clean sample"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":0,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5ae,Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin"), Found reference to API "selectedAdapterId" (Indicator: "select"; Source: "sample.bin"), Found reference to API "WriteAllText" (Indicator: "write"; Source: "sample.bin"), Found reference to API "System.Runtime.CompilerServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "get_OperationalStatus" (Indicator: "lstat"; Source: "sample.bin"), Found reference to API "get_OperationalStatus" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "OperationalStatus" (Indicator: "lstat"; Source: "sample.bin"), Found reference to API "OperationalStatus" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "Microsoft Timestamping Service0" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Microsoft Timestamping Service0" (Indicator: "times"; Source: "sample.bin"), Found reference to API "Microsoft Timestamping PCA" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Microsoft Timestamping PCA" (Indicator: "times"; Source: "sample.bin"), Found reference to API "Microsoft Timestamping PCA0" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Microsoft Timestamping PCA0" (Indicator: "times"; Source: "sample.bin"), Found reference to API " {11111111-1111-1111-1111-111111111111}" (Indicator: "select"; Source: "sample.bin")28:T100a,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CLEANUP\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLVERIFYCERTIFICATECHAINPOLICY") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 1\CERTDLLVERIFYCERTIFICATECHAINPOLICY") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\PHYSICALSTORES") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKCU\") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\PHYSICALSTORES")29:T284e,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000340015000000583a390000000000150000000000000014000000000000000000000000000000000000000000000002000002d8d73800450000450000000000000000000000008000000000000000b27600c4503739000100000000000000020000000c000000d8d83800d8d83800d3d83800000000000000000000003400000000016cf6160000000000f4f7160095e1e676548f0b00feffffff435cea765059ea7694000000a0000000d2d83800d0d838009400000028f81600fdfe607590f71600ec29f06a5c0c0000acf71600ff29f06a00000000000000000000000000000000 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000064910e640000000064910e6400000000c8f516009f48e77666910e6400000000e8f516000000000066910e64ecf516004da300750000000000000000e8f5160064910e6400000000000000000400000018f616000fa3007564910e640200000000000000000000000800000064910e64ffffffff010000800200000068f6160042a20075e9fd00000800000064910e64020000000000000001000000 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000003875004d5c00000028463900c4003400020056001d0000000000340000000000086d340034fd16000c000000380134000000000020ec3700f8693400106b340008123400f06d340002000000000000004800000038fd1600b4fc16002c48026400003400000000004b48026441ac2e40010000002c8d586400000000583a3900533a390000000000f0fc160060175164ffffffff4b480264aa480264000034000000000040000000fcfc1600e543026480dc3800e848026409ac2e40010000002c8d586400000000cb0000000200000024fd1600a0fb5264ffffffffe8480264 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006b0020003100000000003875004d5c00000028463900c4003400020056001d0000000000340000000000086d340034fd16000c000000380134000000000020ec3700f8693400106b340008123400f06d340002000000000000004800000038fd1600b4fc16002c48026400003400000000004b48026441ac2e403f870e6441ac2e40010000002c8d5864000000001cfd1600d0fc160028764e64ffffffff3f870e645d870e6429ac2e40010000002c8d5864000000001cfd1600f8fc160028774e64ffffffff5d870e647b870e64f1ad2e40010000002c8d5864000000001cfd1600 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000039000100010050fb160024fb160024fb16002459eb760000000080fb16000cb7206450fb1600060000009cfb16000c87e77600000000020000009cfb1600626fea763487e776e066f77614d5586472c660750000000001000100060000000000000008d558641839390075d8f06a50de586400000000bacb2bccb616f34c8990d74c2e8af500e066f77640fb16000000000024fd160095e1e676c4810b00feffffff3487e776c4b620644096206480dc3800fcb6206401000000d8fb1600d9b620641cd558640100000080dc3800bcce607500000000000000000000000004fd1600 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000340015000000e048390000000000150000000000000014000000000000000000000000000000000000000000000002000002d8d73800200000200000000000000000000000008000000000000000e1740095403439000100000000000000020000000c000000d8d83800d8d83800d3d838000000000000000000000034000000000108f716000000000024fd160095e1e676548f0b00feffffff435cea765059ea7694000000a0000000d2d83800d0d8380094000000acf81600fdfe60752cf81600ec29f06a5c0c000048f81600ff29f06a00000000000000000000000000000000 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000d2000000d20000000c000000e8383b0001000000020000000200000010000000d426586401000000383d58640100000090f4160020f41600de440264d8183a0050f416009f440264b8440264a5a42e404038380090f416000100000000000000000000006cf416001ce35164ffffffffb84402647d4402648da42e4040383800c81d3b00010000008a4108644da42e4040383800d0383a0000000000739f076445a42e4040383800d0383a0000000000383d586400000000e1a707640000000040383800 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e05a3b0020a53b001000ac00010000000000000084ed00010000000070000000086d340080ec160020000000e8ed160000000000a0543b00f8693400186b3400b8713b00c06e34003c6eea7604ed16000000000038ee1600b8713b00e9e9ea76b8713b00000000002000000000000000000000000800000002000000f8ed160072dc60750000000079dc60756dc0734638b1ff74000000000000fd7400000000000000004cee160070ee1600c71515750000000048ff370000000000b0ed1600c4ed160024ef160002000000000000002800000079dc607548ee1600c9760075 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000110000004017a3010000a301e017a301000000003016c069000000003016c0690000000034ed16009f48e7763216c0690000000054ed1600000000003216c06958ed16004da30075000000000000000054ed16003016c06900000000000000000400000084ed16000fa300753016c069020000000000000000000000080000003016c069ffffffff0100008002000000d4ed160042a20075e9fd0000080000003016c069020000000000000001000000 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000160044e2160002000000020000000100420005000000000000000000000000000000a8e316005477ea7684e216000000000014000000bf77ea7600003869000000000000800004e31600f00038690000000000000000000000000000000000000000000000000000000000000000120014005ce416002ce416000100000000000000ff2bea76447ef776000000009401340000003400347ef776c0713e690000ffff3f00000000000000000000002c0020001b010000010068003f00000084e3160020000000086d34001b01000001000000020000000000000000ec3700f8693400 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001600782f170018ec160080f4ab76000017000000000089f4ab7667a86646020000008cec160088ec1600bcec160098ec1600be321c000000000000001000dceb1600c83ab57650ec1600d58cad768cec160020ec160042a4ab76a802b57660ec1600d2f4ab76080000006ef5ab7644f5ab761fa8664602000000ec360277000017004548027734ec16000200000000001700ec36027764ec160042a4ab76a802b576a8ec1600c035027708000000953502779d49435f02000000ec3602770000170045480277902f1700782f170074ec1600e061047734ed16001ed80277ad905728 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000390062006200310034006600340065003700620039003000640002000000a0254100482d4000f8693400650002001402555368040000140000000355040613025553502d40000304000013000000c06e3400050000000000000065000000783541000ceb1600cc41eb76a025410028000000fb010000ff2bea767076f776d8eb6d75ac0134000000340063000c00140255530000ffffd50000000400000001000000640007001402555302000000010000000000000000000000086d3400f80f0000200000000000000000000000482d4000f8693400186b3400e0254100c06e3400 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000160095e1e6766c810b00feffffffff2bea769a2aea7600000000e4453c0000000000b8453c00690000690000000080000000000000002a55007fd8282e0401000000d8282e040200000008000000b8453c00b8453c00b3453c0000000000eb202e0000003400000000019cee16007f000000020000000000000030000000feffffffa8ef16002c48026400003400000000004b4802645dbf2e4000000000e4453c0024000000b0ef1600609b026400000700e4ef160060175164ffffffff4b480264aa480264000034000000000024000000f0ef1600d3480264a000000000000000 (UID: 00000000-00005672)2a:Td7e,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00760032002e0030002e00350030003700320037005c006d00730063006f00720077006b0073002e0064006c006c002e0032002e0043006f006e00660069006700000002000002 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000636dc2690000a301000000006c6dc26956dd2e40d8d7586478f7160074f716000000246b0000000034f7160000000000d8d75864ccf6160048f716003cf7160078f716000cf71600ff23c269c83bcb694cf716003117c269080000001c5ce97614a1ea76ffffffff2400000034f71600 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f00000000000000000000006d00730063006f00720077006b0073002e00640000000000000032000000000000000000000000000000000000000000 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007494ee1600502dfd74b8713b000000000000000000b4ee16001c2dfd740000fd740100000000000000010000000100000001000000d4ee16003429fd740000fd74010000000000000004f01600000000000100000000000000010000000000fd74010000000000000000000000f4ee1600 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006968ee16003117c269080000001c5ce97614a1ea76ffffffff2400000050ee160004000000000000000100000034f9c069010000009cee1600935ceb764083f276d4a0ea76e073f77600000000010000000100000040393800000000006cee16001bc66075d8ee160095e1e67684990b00 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000b000000ece31600f8e31600020000000000000010000000dce31600f8e31600c97600750000340000001400da76007524ce7346000000000000386901000000935ceb76000000000000000000000000c0e316000100000090e61600bd0602753c5b653300000000bd143869f8903800 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb6d75e02541000060fd7f9a5ceb7600f0fd7fcceb16004460fd7f00000000400000003f000000210000000060fd7fc0eb1600c15ceb766082f276210000000060fd7f9a5ceb7600f0fd7fe4eb16005789ea768083f27613170175d8eb6d75 (UID: 00000000-00005672)2b:T1026,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "QUERYADAPTERNAME"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONMAXADDRESSCOUNT"; Value: "")2c:T865,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")2d:T282e,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter RichEd20.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter mscorsec.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter imagehlp.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter wshtcpip (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter wship6.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter AdvApi32.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\ad8dd536906e94c4bc9cb9b82285580b\System.Configuration.ni.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll (UID: 00000000-00005672)2e:Tbe11,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter _set_error_mode (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ?set_terminate@@YAP6AXXZP6AXXZ@Z (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter _get_terminate (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SetLoadedByMscoree (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetCLRFunction (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter IEE (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter IEE_RetAddr (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetStartupFlags (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetStartupFlags_RetAddr (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetHostConfigurationFile_RetAddr (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetCORVersion_RetAddr (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetCORVersion (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RemoveVectoredContinueHandler (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetWriteWatch (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ResetWriteWatch (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CreateMemoryResourceNotification (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter QueryMemoryResourceNotification (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetPublisher (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CoInitializeEE (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CoInitializeEE_RetAddr (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WintrustCertificateTrust (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CORPolicyEE (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptSIPPutSignedDataMsg (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptSIPGetSignedDataMsg (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ImageGetCertificateData (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WVTAsn1SpcIndirectDataContentDecode (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptSIPVerifyIndirectData (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WVTAsn1SpcPeImageDataDecode (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptSetHashParam (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptVerifySignatureA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptRetrieveObjectByUrlW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHEnumProtocols (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHGetProviderGuid (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHGetWSAProtocolInfo (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHGetWinsockMapping (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpTimeFromSystemTime (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter StrStrIW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter QueryServiceConfigA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ChangeServiceConfigA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RpcEpResolveBinding (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RpcStringFreeA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CertDllVerifyRevocation (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SoftpubAuthenticode (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SaferiSearchMatchingHashRules (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CoUninitializeEE (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CoUninitializeEE_RetAddr (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptGenKey (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptSignHashA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptGetUserKey (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CryptEnumProvidersA (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter lstrlen (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptor (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CreateWellKnownSidW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter OpenMutex (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter OpenMutexW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter inet_addr (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetAdaptersInfo (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetIfEntry (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetPerAdapterInfo (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005672)2f:Ta80,"Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005672.00000001.81359.00340000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\." in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\." in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\Library" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\IsMultiInstance" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\First Counter" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\." in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\CategoryOptions" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\FileMappingSize" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\Counter Names" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp30:T4f0,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" - [base:0; Status:c0000135] "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" failed to load missing module "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135]31:Ta80,"Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005672.00000001.81359.00340000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\." in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\." in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\Library" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\IsMultiInstance" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\First Counter" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\." in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\CategoryOptions" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\FileMappingSize" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance\Counter Names" in Source: 00000000-00005672.00000001.81359.01D10000.00000004.mdmp32:T2036,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 707c0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "KERNEL32" at base 755c0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "ADVAPI32.DLL" at base 750f0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b240000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "SHLWAPI.DLL" at base 75090000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "VERSION.DLL" at base 741f0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL" at base 64020000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "USER32.DLL" at base 76d80000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "MSCOREE.DLL" at base 6b2d0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "NTDLL" at base 76e50000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "SHELL32.DLL" at base 756f0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "OLE32.DLL" at base 75200000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "KERNEL32.DLL" at base 755c0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76fc0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "PROFAPI.DLL" at base 74d70000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\9F895C66454577EFF9C77442D0C84F71\MSCORLIB.NI.DLL" at base 63520000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "IMM32.DLL" at base 77000000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "RICHED20.DLL" at base 69380000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORSEC.DLL" at base 69c00000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "MSCORSEC.DLL" at base 69c00000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "CRYPTSP.DLL" at base 74760000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 744f0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "CRYPTBASE.DLL" at base 74c50000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "WINTRUST.DLL" at base 74fd0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 74e40000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "IMAGEHLP.DLL" at base 77020000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "NCRYPT.DLL" at base 74890000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74430000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "BCRYPT.DLL" at base 74870000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "USERENV.DLL" at base 74f80000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "GPAPI.DLL" at base 74330000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76fc0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "RPCRT4.DLL" at base 754d0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 76fc0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 70e10000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "CRYPTNET.DLL" at base 70e10000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "SENSAPI.DLL" at base 69bf0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "WINHTTP.DLL" at base 70b10000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "WS2_32.DLL" at base 75580000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "SSPICLI.DLL" at base 74be0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "CREDSSP.DLL" at base 74420000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74720000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "WSHTCPIP" at base 74280000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "WSHIP6.DLL" at base 74710000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 714c0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "IPHLPAPI.DLL" at base 730b0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "DHCPCSVC6.DLL" at base 72fb0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "DHCPCSVC.DLL" at base 72ee0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "NTDLL.DLL" at base 76e50000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "NSI.DLL" at base 76fe0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "CFGMGR32.DLL" at base 75050000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "OLEAUT32.DLL" at base 75360000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 76fc0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "DNSAPI.DLL" at base 745e0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74280000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74710000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "RASADHLP.DLL" at base 714b0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72fe0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76fc0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL" at base 693a0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\AD92DAB7F418877D6A1E0358CE35658A\SYSTEM.NI.DLL" at base 62d70000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\AD8DD536906E94C4BC9CB9B82285580B\SYSTEM.CONFIGURATION.NI.DLL" at base 692a0000 "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\77C1DC46EA139BF5E1EAA9B87EF03C7A\SYSTEM.XML.NI.DLL" at base 6283000033:T4bd,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"34:T858,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005672-00000C2B-260641839] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00005672-00000C2B-261060778] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll" [Source: 00000000-00005672-00000C2B-263837334] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll" [Source: 00000000-00005672-00000C2B-264319016] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00005672-00000C2B-265030871] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00005672-00000C2B-265800753] Observed system executable string:"%WINDIR%\system32\cryptnet.dll" [Source: 00000000-00005672-00000C2B-266550566] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ole32.dll" [Source: 00000000-00005672-00000C2B-272569796] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll" [Source: 00000000-00005672-00000C2B-273451812] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\ad92dab7f418877d6a1e0358ce35658a\System.ni.dll" [Source: 00000000-00005672-00000C2B-274633060] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00005672-00000C2B-274971430] Observed system executable string:"%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00005672-00000C2B-275266024] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\ad8dd536906e94c4bc9cb9b82285580b\System.Configuration.ni.dll" [Source: 00000000-00005672-00000C2B-275485450] Observed system executable string:"%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\77c1dc46ea139bf5e1eaa9b87ef03c7a\System.Xml.ni.dll" [Source: 00000000-00005672-00000C2B-275623343]35:Tf43,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 0) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKCU\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 5; Subtree: 1) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" monitors "HKLM\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0)36:T803,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "")37:Tcdb,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "GCSTRESSSTART"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "GCSTRESSSTARTATJIT"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "8DD2D00251E4DADD9C5582749BB14F4E7B90DCBEC021D1BB8B303D0EDEE1D9A5"; Value: "")38:Tcfc,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\FLTLIB.DLL" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\MSVCP140.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\VCRUNTIME140.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\ucrtbase.DLL" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"39:T547,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch"3a:Tcf7,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\FLTLIB.DLL" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\MSVCP140.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\ucrtbase.DLL" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"3b:T6de,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe.config" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe.Local\" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}" "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{F6CE0B02-1D3A-4AAB-827F-12846404CB65}"3c:T58f,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00005672-00000C2C-268199477") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00005672-00000C2C-269212217") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00005672-00000C2C-269441114") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00005672-00000C2C-269441114") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00005672-00000C2C-269441114") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00005672-00000C2C-271012825") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00005672-00000C2C-271012825") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00005672-00000C2C-271214447") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005672-00000C2C-271215199") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00005672-00000C2C-271225593") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00005672-00000C2C-271226406") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005672-00000C2C-275475327")3d:T3490,Found URL "http://www.microsoft.com/rfid/picknic.xsd" - Source: "00000000-00005672.00000001.81359.001C2000.00000020.mdmp") Found URL "http://www.microsoft.com/rfid/picknic.xsdfmulticastnetworkadapterconfig" - Source: "00000000-00005672.00000001.81359.001C2000.00000020.mdmp") Found URL "http://www.microsoft.com/rfid/picknic.xsdtisnullableselectedadapteridmicrosoft" - Source: "00000000-00005672.00000001.81359.001C2000.00000020.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crldevice\" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0hsz%e-mme)vrmc@ugt!ewashington1redmond1microsoft" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/tspca.crl0h<0:08,http://www.microsoft.com/pki/certs/tspca.crt0e&>d3" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.2.840.113549.1.1.2p1<92a@ef6" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/p1<92a@ef" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n(" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o67" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0j." - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr," - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nd1r06x7y1%2+jopijlf0cth" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!entrust.net1;092www.entrust.net/cps" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0et/c16162efxgi0a0" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7y" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?q" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://wft.com/pki/certs/miccerlisca20-29.crt0w" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005672.00000001.81359.00340000.00000004.mdmp") Found URL "http://www.microsoft.com/rfid/picknic.xsd" - Source: "00000000-00005672.00000001.81359.01D10000.00000004.mdmp") Found URL "http://datadirectoryuser.configc:\8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe.configc:\8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe.configfile:///c:/8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exefile///c:/8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exec:/8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\:*?" - Source: "00000000-00005672.00000001.81359.01D10000.00000004.mdmp") Found URL "http://www.w3.org/2000/xmlns/http://www.w3.org/xml/1998/namespacepolicyimporters>" - Source: "00000000-00005672.00000001.81359.01D10000.00000004.mdmp") Found URL "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab,@451fb0c,4,7c060000http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00005672.00000001.81359.042E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0hsz%e-mme)vrmc@ugt!e';" - Source: "00000000-00005672.00000001.81359.042E0000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00005672.00000001.81359.042E0000.00000004.mdmp") Found URL "http://crl.microm_mf.cki/crl/products/microsoftrootcert.crl0th0f0e_mf8http://www.microsofy_mfm/certs/microsoftrootcer]_mft0>u_mfl>ej-+\l-_mfu>%_mfpob\hz:_mf=_mfaxr" - Source: "00000000-00005672.00000001.81359.042E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/cspca.crl0h<0:08,http://www.microsoft.com/pki/certs/cspca.crt0hsz%e-mme)vrmc@ugt!e" - Source: "00000000-00005672.00000001.81359.042E0000.00000004.mdmp") Found URL "http://crl.micro\bmf.cki/crl/products/micros0bmfoot.crl0th0f04bmf8http://www.microsofbmfm/certs/microsoftrootcerbmft0bmflbmfu>pob\hzagbmfaxr" - Source: "00000000-00005672.00000001.81359.042E0000.00000004.mdmp")3e:T515,Found string "for Oracle" type="System.Data.OracleClient.OracleClientFactory, System.Data.Ora" (Indicator: "System.Data.OracleClient"; Source: "00000000-00005672.00000000.80612.00340000.00000004.mdmp") Found string "name="SqlClient Data Provider" invariant="System.Data.SqlClient" description="." (Indicator: "System.Data.SqlClient"; Source: "00000000-00005672.00000000.80612.00340000.00000004.mdmp"), Found string "ramework Data Provider for SqlServer" type="System.Data.SqlClient.SqlClientFact" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005672.00000000.80612.00340000.00000004.mdmp"), Found string "System.Data.SqlClient.SqlClientFactory System.Data Version=2.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005672.00000001.81359.01D10000.00000004.mdmp"), Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005672.00000001.81359.01D10000.00000004.mdmp"), Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005672.00000001.81359.01D10000.00000004.mdmp")3f:Teac,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005672)40:T616,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetAdaptersInfo" (UID: 00000000-00005672) "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" called "GetAdaptersInfo" with parameter "000000000c0000007b30374234314637392d314145432d343738322d413645382d3843323846464241333545447d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000496e74656c2852292050524f2f31303030204d54204e6574776f726b20436f6e6e656374696f6e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000005619667467d100000c000000060000000100000000000000000000003139322e3136382e302e3200000000003235352e3235352e3235352e30000000c0a80002000000003139322e3136382e302e3100000000003235352e3235352e3235352e32353500c0a80001000000003139322e3136382e302e3100000000003235352e3235352e3235352e32353500c0a8000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007ead96a873bdb6a497e5269ac6e0300" - (UID: 00000000-00005672)41:T10a7,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")42:T1324,"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGFLAGS"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENDEFAULTSERVERS"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DYNAMICSERVERQUERYORDER"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "FILTERCLUSTERIP"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "WAITFORNAMEERRORONALL"; Value: "") "8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEEDNS"; Value: "")43:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"clean","threat_score":0,"unified_at_epoch_ms":1792666528977,"unified_at":"2026-10-22T10:55:28.977Z","metadata":{"hashes":{"sha256":"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5","sha1":"e7a6340df057c94f45c8367d4bc6df34aeffdb28","md5":"4c099209f334b10c84e7c10fb5b9ca5f","sha512":"609cc6b33539a2c007a81b1d2fafb91f122bc923901bb6d469e99415730de78da68b05389f67d208a4920dd52cdc661986ebcf572df7bd1ab14ec2b538dece7c","ssdeep":"192:RymeCujtaflg4quEMLqfWV0OdWdQKPnEtTIXXYxHz+ehjT/Gy+T:ICu+lgrHMoWVhdWdLz4Z1jCv","ssdeep_chunks":["192:RymeCuj","192:ymeCujt","192:meCujta","192:eCujtaf","192:Cujtafl","192:ujtaflg","192:jtaflg4","192:taflg4q","192:aflg4qu","192:flg4quE","192:lg4quEM","192:g4quEML","192:4quEMLq","192:quEMLqf","192:uEMLqfW","192:EMLqfWV","192:MLqfWV0","192:LqfWV0O","192:qfWV0Od","192:fWV0OdW","192:WV0OdWd","192:V0OdWdQ","192:0OdWdQK","192:OdWdQKP","192:dWdQKPn","192:WdQKPnE","192:dQKPnEt","192:QKPnEtT","192:KPnEtTI","192:PnEtTIX","192:nEtTIXX","192:EtTIXXY","192:tTIXXYx","192:TIXXYxH","192:IXXYxHz","192:XXYxHz+","192:XYxHz+e","192:YxHz+eh","192:xHz+ehj","192:Hz+ehjT","192:z+ehjT/","192:+ehjT/G","192:ehjT/Gy","192:hjT/Gy+","192:jT/Gy+T","384:RymeCuj","384:ymeCujt","384:meCujta","384:eCujtaf","384:Cujtafl","384:ujtaflg","384:jtaflg4","384:taflg4q","384:aflg4qu","384:flg4quE","384:lg4quEM","384:g4quEML","384:4quEMLq","384:quEMLqf","384:uEMLqfW","384:EMLqfWV","384:MLqfWV0","384:LqfWV0O","384:qfWV0Od","384:fWV0OdW","384:WV0OdWd","384:V0OdWdQ","384:0OdWdQK","384:OdWdQKP","384:dWdQKPn","384:WdQKPnE","384:dQKPnEt","384:QKPnEtT","384:KPnEtTI","384:PnEtTIX","384:nEtTIXX","384:EtTIXXY","384:tTIXXYx","384:TIXXYxH","384:IXXYxHz","384:XXYxHz+","384:XYxHz+e","384:YxHz+eh","384:xHz+ehj","384:Hz+ehjT","384:z+ehjT/","384:+ehjT/G","384:ehjT/Gy","384:hjT/Gy+","384:jT/Gy+T","192:ICu+lgr","192:Cu+lgrH","192:u+lgrHM","192:+lgrHMo","192:lgrHMoW","192:grHMoWV","192:rHMoWVh","192:HMoWVhd","192:MoWVhdW","192:oWVhdWd","192:WVhdWdL","192:VhdWdLz","192:hdWdLz4","192:dWdLz4Z","192:WdLz4Z1","192:dLz4Z1j","192:Lz4Z1jC","192:z4Z1jCv"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":13656,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792666430000,"last_seen":1792666430000,"last_multi_scan":1792666430000}},"detections":{"summary":{"verdict":"clean","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":43},"sandbox_signatures":{"informative_count":115,"suspicious_count":1,"malicious_count":0,"total":116},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"whitelisted","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieves adapter information"},{"type":"informative","value":"Contains ability to retrieve network adapter information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"Drops cabinet archive files"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to communicate with HTTP server"},{"type":"informative","value":"Attempts to call internet-related API for network communication"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Calls an API typically used to import cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-62","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"ListMulticastNics.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"crl.microsoft.com/pki/crl/products/cspca.crl0h\", Pattern match: \"http://www.microsoft.com/pki/certs/cspca.crt0\", Pattern match: \"crl.microsoft.com/pki/crl/products/tspca.crl0h\", Pattern match: \"http://www.microsoft.com0\", Pattern match: \"http://www.microsoft.com/rfid/picknic.xsdf\", Pattern match: \"http://www.microsoft.com/rfid/picknic.xsdt\", Pattern match: \"http://www.microsoft.com/pki/certs/tspca.crt0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"3.7.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00005672.00000000.80612.00340000.00000004.mdmp, 00000000-00005672.00000001.81359.00340000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005672.00000001.81359.00340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" at 00000000-00005672-00000105-5028539","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 5672)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00005672.00000001.81359.01D10000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005672.00000001.81359.01D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00005672-00000C2C-265795596\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00005672-00000C2C-266054126\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"CryptAcquireContextA\" with parameters {\"phProv\": \"a8463d00\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531872\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to import cryptographic keys into a CSP","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"CryptImportKey\" with parameters {\"hProv\": \"3d46a8\"\n \"pbData\": \"0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9\"\n \"dwDataLen\": \"148\"\n \"dwFlags\": \"0\"\n \"phKey\": \"c02d3d00\"}","origin":"API Call","mitre_attack_id":"T1486","relevance":1,"id":"api-233","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00005672.00000001.81359.01D10000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005672.00000001.81359.01D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005672.00000000.80612.00340000.00000004.mdmp, 00000000-00005672.00000001.81359.00340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00005672.00000001.81359.00340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has high entropy 7.95594","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 10710; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 9657; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005672-00000C2C-263989736\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005672-00000C2C-261671297\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005672-00000C2C-261672045\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005672-00000C2C-271150412\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005672)\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005672)\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005672)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005672)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"IsWow64Process\" with parameter \"5672\" - (UID: 00000000-00005672)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005672)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00005672)\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"OpenMutexW\" with parameter \"Global\\.net clr networking\" - (UID: 00000000-00005672)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00005672)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00005672)\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005672)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" queried token user identity (UID: 00000000-00005672)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/23 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00005672)\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00005672)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"\n Process 8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe created mutex with name \"Global\\.net clr networking\"\n Process 8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe created mutex with name \"Global\\CLR_PerfMon_WrapMutex\"\n Process 8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"info@diginotar.nl\"\n Pattern match: \"cps-requests@verisign.com\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$31","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 756A0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 69380000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 63520000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74870000\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74430000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 754D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e002203316b@ADVAPI32.dll\"\n \"0d000e00fe02316b@ADVAPI32.dll\"\n \"0b000c00cc02316b@ADVAPI32.dll\"\n \"10001100da02316b@ADVAPI32.dll\"\n \"150016002073f16a@ADVAPI32.dll\"\n \"0e000f00e473f16a@ADVAPI32.dll\"\n \"0e000f005074f16a@ADVAPI32.dll\"\n \"11001200d47df16a@ADVAPI32.dll\"\n \"110012007c7ef16a@ADVAPI32.dll\"\n \"12001300cc7ef16a@ADVAPI32.dll\"\n \"12001300387ff16a@ADVAPI32.dll\"\n \"14001500dcb8f16a@ADVAPI32.dll\"\n \"14001500f8b8f16a@ADVAPI32.dll\"\n \"1400150014b9f16a@ADVAPI32.dll\"\n \"1700180030b9f16a@ADVAPI32.dll\"\n \"0d000e004cb9f16a@ADVAPI32.dll\"\n \"110012005cb9f16a@ADVAPI32.dll\"\n \"1100120074b9f16a@ADVAPI32.dll\"\n \"0f001000e4baf16a@ADVAPI32.dll\"\n \"1400150030bbf16a@ADVAPI32.dll\"\n \"140015004cbbf16a@ADVAPI32.dll\"\n \"0c000d00a0bbf16a@ADVAPI32.dll\"\n \"0c000d00b0bbf16a@ADVAPI32.dll\"\n \"0e000f00c0bbf16a@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5\" was detected as \".NET\" and name: \"Library\"\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$33","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00005672.00000001.81359.00340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Root Authority, OU=Microsoft Corporation, OU=Copyright c 1997 Microsoft Corp.\" (SHA1: 30:36:E3:B2:5B:88:A5:5B:86:FC:90:E6:E9:EA:AD:50:81:44:51:66; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 9E:95:C6:25:D8:1B:2B:A9:C7:2F:D7:02:75:C3:69:96:13:AF:61:E3; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Timestamping PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: A1:DC:02:4F:C8:B2:A7:67:45:D4:66:1F:66:3B:87:41:C3:D3:53:13; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Authority, OU=Microsoft Corporation, OU=Copyright c 1997 Microsoft Corp.\" (SHA1: 3E:A9:9A:60:05:82:75:E0:ED:83:B8:92:A9:09:44:9F:8C:33:B2:45; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 5652 bytes 1 file at 0x2c last modified Oct 18 2026 18:55:36 +A \"disallowedcert.stl\" number 1 1 datablock 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005672]\n \"PickNic.xml\" has type \"XML 1.0 document ASCII text with CRLF line terminators\"- Location: [C:\\PickNic.xml]- [targetUID: 00000000-00005672]\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005672]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"PickNic.xml\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [C:\\PickNic.xml]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00005672.00000000.80612.009A0000.00000002.mdmp\n \"Progman\" (Program manager) in Source: 00000000-00005672.00000000.80612.009A0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$35","origin":"API Call","mitre_attack_id":"T1012","relevance":1,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" opens a process \"C:\\8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" (UID: 00000000-00005672)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config\"\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\57c8edb95df3f0ad4ee2dc2b8cfd4157\"\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\7b2238aaccedc3f1ffe8e7eb5f575ec9\"\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\7b2238aaccedc3f1ffe8e7eb5f575ec9\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Tries to sleep for a long time (more than two minutes)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\57c8edb95df3f0ad4ee2dc2b8cfd4157\"\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\57c8edb95df3f0ad4ee2dc2b8cfd4157\"\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" writes file \"c:\\picknic.xml\"\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" writes file \"%localappdata%\\ow\\microsoft\\cryptneturlcache\\content\\57c8edb95df3f0ad4ee2dc2b8cfd4157\"\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" writes file \"%localappdata%\\ow\\microsoft\\cryptneturlcache\\metadata\\57c8edb95df3f0ad4ee2dc2b8cfd4157\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00005672-00000C2C-275475998\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"WinHttpConnect\" with parameters (UID: 00000000-00005672)\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"WinHttpOpenRequest\" with parameters (UID: 00000000-00005672)\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"WinHttpSendRequest\" with parameters (UID: 00000000-00005672)\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"WinHttpReceiveResponse\" with parameters (UID: 00000000-00005672)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to communicate with HTTP server","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"WinHttpConnect\" to server \"ctldl.windowsupdate.com\" on port 80 (UID: 00000000-00005672)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-187","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"430120\"\n \"lpszHeaders\": \"If-None-Match: \\\"084627641cfd61:0\\\"If-Modified-Since: Thu, 10 Dec 2020 22:11:52 GMT\"\n \"dwHeadersLength\": \"4294967295\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"430120\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" in \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00005672-00000C2C-275475327\")\n Found reference to API \"inet_addr\" (Indicator: \"inet_addr\"; Source: \"00000000-00005672-00000C2C-276001314\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00005672.00000000.80612.009A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00005672.00000001.81359.00340000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005672.00000001.81359.042E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \":\\Windows\\system32\\kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00005672.00000001.81359.00340000.00000004.mdmp\")\n Found string \"crosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00005672.00000001.81359.00340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieves adapter information","description":"$40","origin":"API Call","mitre_attack_id":"T1016","relevance":5,"id":"api-153","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00005672.00000000.80612.00340000.00000004.mdmp, 00000000-00005672.00000001.81359.00340000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"RsaCryptoServiceProvider\"; Source: \"00000000-00005672.00000001.81359.01D10000.00000004.mdmp\")\n Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RsaCryptoServiceProvider\"; Source: \"00000000-00005672.00000001.81359.01D10000.00000004.mdmp\")\n Found string \"e=neutral, PublicKeyToken=b03f5f7f11d50a3a\" description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\" keyContainerName=\"NetFrameworkConfigurationKey\" cspProviderName=\"\" useMachineContainer=\"true\" useOAEP=\"false\"/>\" (Indicator: \"RsaCryptoServiceProvider\"; Source: \"00000000-00005672.00000001.81359.01D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"6630228,5656,3185,,GetAdaptersAddresses,Iphlpapi.dll,\"00:36:18.976\",RX=0,PX=0\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00005672.00000001.81359.042E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"\"true\" applicationName=\"/\" requiresUniqueEmail=\"false\" passwordFormat=\"Hashed\"\" (Indicator: \"password\"; Source: \"00000000-00005672.00000000.80612.00340000.00000004.mdmp, 00000000-00005672.00000001.81359.00340000.00000004.mdmp\")\n Found string \"aracters=\"1\" passwordAttemptWindow=\"10\" passwordStrengthRegularExpression=\"\"/>\" (Indicator: \"password\"; Source: \"00000000-00005672.00000000.80612.00340000.00000004.mdmp, 00000000-00005672.00000001.81359.00340000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00005672.00000001.81359.01D10000.00000004.mdmp\")\n Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00005672.00000001.81359.01D10000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00005672.00000001.81359.01D10000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00005672.00000001.81359.01D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"login.skype.com0\" (Indicator: \"skype.com\")\n \"login.skype.com\" (Indicator: \"skype.com\")\n \"www.login.skype.com0\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch.5672.2159668\" with delete access\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch.5672.2159668\" with delete access\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\SECURITY.CONFIG.CCH.5672.2159668\" with delete access\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\ENTERPRISESEC.CONFIG.CCH.5672.2159668\" with delete access\n \"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\CLR SECURITY CONFIG\\V2.0.50727.312\\SECURITY.CONFIG.CCH.5672.2161727\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; Source: \"00000000-00005672-00000C2C-271447404\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005672.00000000.80612.00340000.00000004.mdmp, 00000000-00005672.00000001.81359.00340000.00000004.mdmp\")\n Found string \"\\Device\\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005672.00000001.81359.00340000.00000004.mdmp\")\n Found string \"\\Device\\{90A066FE-591C-47F3-850D-9644B684FBA5}\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005672.00000001.81359.00340000.00000004.mdmp\")\n Found string \"\\DEVICE\\TCPIP_{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005672.00000001.81359.00340000.00000004.mdmp, 00000000-00005672.00000001.81359.01D10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$41","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\137\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 5652 bytes 1 file at 0x2c last modified Oct 18 2026 18:55:36 +A \"disallowedcert.stl\" number 1 1 datablock 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005672]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005672]\n Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005672]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe\" connects to 199.232.210.172 on port 80 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]}],"intel_graph":{"map":{"File:0cd0c0971a7cc865b6f252dcb8ac727adc00702d7ff70a3918ce2bc3d569517b":{"type":"File","value":"0cd0c0971a7cc865b6f252dcb8ac727adc00702d7ff70a3918ce2bc3d569517b"},"File:1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0":{"type":"File","value":"1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0"},"File:8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5":{"type":"File","value":"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5","verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database"]}}},"chains":[{"id":"1562781025335265839","root":"File:8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5","edges":[],"verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database"]}},{"id":"sandbox_files","root":"File:8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5","edges":[{"edge_kind":"extracted","from_key":"File:8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5","to_key":"File:1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0"},{"edge_kind":"extracted","from_key":"File:8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5","to_key":"File:0cd0c0971a7cc865b6f252dcb8ac727adc00702d7ff70a3918ce2bc3d569517b"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":87,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6ad9eb3e3241ab8bf70f4260","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"clean","submit_name":"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5","analysis_start_time":"2026-10-22T10:53:50+00:00","indicators_count":{"informative":114,"suspicious":1,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}],"processes":[{"pid":5672,"ppid":0,"name":"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe","command_line":"","sha256":"8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5","normalized_path":"C:\\8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5.exe","uid":"00000000-00005672","icon":"$43"}],"all_imported_dlls":["cryptsp.dll","rpcrt4.dll","user32.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-utility-l1-1-0.dll","ole32.dll","credssp.dll","Wldap32.dll","wship6.dll","dhcpcsvc.dll","msvcrt.dll","lpk.dll","api-ms-win-crt-math-l1-1-0.dll","mscoreei.dll","sechost.dll","nsi.dll","wintrust.dll","userenv.dll","SensApi.dll","api-ms-win-core-processthreads-l1-1-1.dll","cryptbase.dll","cfgmgr32.dll","api-ms-win-core-timezone-l1-1-0.dll","imagehlp.dll","sspicli.dll","mswsock.dll","msvcp140.dll","msasn1.dll","rasadhlp.dll","System.Xml.ni.dll","tzres.dll","mscoree.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-time-l1-1-0.dll","bcryptprimitives.dll","winhttp.dll","wshqos.dll","System.ni.dll","kernel32.dll","ws2_32.dll","vcruntime140.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","FWPUCLNT.DLL","gdi32.dll","api-ms-win-core-file-l1-2-0.dll","imm32.dll","msctf.dll","shlwapi.dll","msvcr80.dll","gpapi.dll","mscorjit.dll","fltLib.dll","api-ms-win-crt-heap-l1-1-0.dll","ncrypt.dll","IPHLPAPI.DLL","dnsapi.dll","ntdll.dll","VxSSL32.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","mscorsec.dll","rsaenh.dll","cryptnet.dll","usp10.dll","api-ms-win-crt-runtime-l1-1-0.dll","ucrtbase.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","oleaut32.dll","shell32.dll","mscorlib.ni.dll","mscorwks.dll","profapi.dll","bcrypt.dll","winnsi.dll","dhcpcsvc6.dll","System.Configuration.ni.dll","api-ms-win-crt-string-l1-1-0.dll","version.dll","WSHTCPIP.DLL","KernelBase.dll","advapi32.dll","crypt32.dll","comctl32.dll","webio.dll","riched20.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"name":"PickNic.xml","sha256":"0cd0c0971a7cc865b6f252dcb8ac727adc00702d7ff70a3918ce2bc3d569517b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F6CE0B02-1D3A-4AAB-827F-12846404CB65}","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"path":"C:\\PickNic.xml","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6ad9eb3e3241ab8bf70f4260"}]}]}},"report_ids":{"sandbox_job_ids":["6ad9eb3e3241ab8bf70f4260"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Clean Sample 8dd2d00251e4… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Clean verdict for sample 8dd2d00251e4…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5"}],["$","meta","4",{"property":"og:title","content":"Clean Sample 8dd2d00251e4… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Clean verdict for sample 8dd2d00251e4…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8dd2d00251e4dadd9c5582749bb14f4e7b90dcbec021d1bb8b303d0edee1d9a5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Clean Sample 8dd2d00251e4… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Clean verdict for sample 8dd2d00251e4…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L44","11",{}]]