21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 5e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious LummaStealer.Generic Sample 92a24e160937… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 92a24e160937…. Malware family: LummaStealer.Generic. Threat score 100/100. 13/24 AV engines flagged this file. 17 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883","keywords":["Malicious","LummaStealer.Generic","malware analysis","sandbox report","threat intelligence","92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883"],"about":{"@type":"SoftwareApplication","name":"Setup.exe","applicationCategory":["compressed","7zip"],"identifier":"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"LummaStealer.Generic","antivirusDetections":{"malicious":13,"total":24},"behavioralIndicators":{"malicious":17,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T2efe,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "Module32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatW"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetAsyncKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "wvsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperW"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "Module32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynW"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "TrackPopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")23:T85e,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8860112'}" (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8860048'}" (UID: 00000000-00003912) "Christmas.pif" called "LoadResource with parameter {'hModule': '10878976', 'hResInfo': '11703704'}" (UID: 00000000-00001400) "Christmas.pif" called "LoadResource with parameter {'hModule': '10878976', 'hResInfo': '11703480'}" (UID: 00000000-00001400) "Christmas.pif" called "LoadResource with parameter {'hModule': '10878976', 'hResInfo': '11703736'}" (UID: 00000000-00001400) "Christmas.pif" called "LoadResource with parameter {'hModule': '10878976', 'hResInfo': '11703544'}" (UID: 00000000-00001400) "Christmas.pif" called "LoadResource with parameter {'hModule': '10878976', 'hResInfo': '11703720'}" (UID: 00000000-00001400) "Christmas.pif" called "LoadResource with parameter {'hModule': '10878976', 'hResInfo': '11703528'}" (UID: 00000000-00001400) "Christmas.pif" called "LoadResource with parameter {'hModule': '10878976', 'hResInfo': '11703496'}" (UID: 00000000-00001400) "Christmas.pif" called "LoadResource with parameter {'hModule': '10878976', 'hResInfo': '11703752'}" (UID: 00000000-00001400) "Christmas.pif" called "LoadResource with parameter {'hModule': '10878976', 'hResInfo': '11703512'}" (UID: 00000000-00001400) "Christmas.pif" called "LoadResource with parameter {'hModule': '54591489', 'hResInfo': '54718240'}" (UID: 00000000-00001400) "Christmas.pif" called "LoadResource with parameter {'hModule': '54591489', 'hResInfo': '54693392'}" (UID: 00000000-00001400) "Christmas.pif" called "LoadResource with parameter {'hModule': '1899954176', 'hResInfo': '1900130824'}" (UID: 00000000-00001400) "RegAsm.exe" called "LoadResource with parameter {'hModule': '1788477440', 'hResInfo': '1789518200'}" (UID: 00000000-00001212) "RegAsm.exe" called "LoadResource with parameter {'hModule': '1788477440', 'hResInfo': '1789518184'}" (UID: 00000000-00001212)24:T1dd5,Found reference to "AesGcm256" (Indicator: "Aes"; File: "00001212.000004BC.48438638.00070000.wprm") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00001212.000004BC.48438638.00070000.wprm") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00001212.000004BC.48438638.00070000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00001212.000004BC.48438638.00070000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00001212.000004BC.48438638.00070000.wprm") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00001212.00000001.82347.00390000.00000004.mdmp, 00000000-00001212.00000002.84272.00390000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000001.82347.6C901000.00000020.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp")25:Ta1e,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PROPERTYBAG") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PROPERTYBAG") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-2092356043-4041700817-663127204-1001") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-2092356043-4041700817-663127204-1001") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION")26:T4e7,Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001212.00000001.82347.6C901000.00000020.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00001212.00000001.82347.6C901000.00000020.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00001212.00000001.82347.6C901000.00000020.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00001212.00000001.82347.6C901000.00000020.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001212.00000001.82347.6C901000.00000020.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00001212.00000001.82347.6C901000.00000020.mdmp") Found api reference "CertOIDToAlgId" (Indicator: "CertOIDToAlgId"; Source: "00000000-00001212.00000001.82347.6C901000.00000020.mdmp") Found api reference "CryptFindOIDInfo" (Indicator: "CryptFindOIDInfo"; Source: "00000000-00001212.00000001.82347.6C901000.00000020.mdmp") Found api reference "CryptEncodeObject" (Indicator: "CryptEncodeObject"; Source: "00000000-00001212.00000001.82347.6C901000.00000020.mdmp")27:T106e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001400-28677-41-00A8A3F8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001400-28677-41-00A8A3F8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001400-28677-45-00A88E89 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001400-28677-45-00A88E89 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001400-28677-51-00A95CAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001400-28677-51-00A95CAC Assembly shows XOR instruction xor eax dword ptr [00B20D50h] in Stream UID: 00000000-00001400-28677-64-00A8A05B Assembly shows XOR instruction xor eax dword ptr [00B20D50h] in Stream UID: 00000000-00001400-28677-68-00A8A016 Assembly shows XOR instruction xor eax dword ptr [00B20D50h] in Stream UID: 00000000-00001400-28677-71-00A89FF7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001400-28677-154-00A8DBA5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001400-28677-154-00A8DBA5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001400-28677-185-00A8B19D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001400-28677-185-00A8B19D Assembly shows XOR instruction xor eax dword ptr [00B20D50h] in Stream UID: 00000000-00001400-28677-326-00A94C14 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001400-28677-454-00A9598B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001400-28677-454-00A9598B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001400-28677-464-00A9AEC3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001400-28677-464-00A9AEC3 Assembly shows XOR instruction xor eax dword ptr [00B20D50h] in Stream UID: 00000000-00001400-28677-465-00A94B20 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001400-28677-471-00A8F18E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001400-28677-471-00A8F18E Assembly shows XOR instruction xor eax dword ptr [00B20D50h] in Stream UID: 00000000-00001400-28677-488-00A94B96 Assembly shows XOR instruction xor eax dword ptr [00B20D50h] in Stream UID: 00000000-00001400-28677-489-00A94BDF Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00001400-28677-556-00A8CD51 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00001400-28677-556-00A8CD51 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00001400-28677-556-00A8CD51 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00001400-28677-556-00A8CD51 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001400-28677-745-00A85AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001400-28677-745-00A85AF0 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00001400-28677-858-00A62BA9 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00001400-28677-891-00AE7F6B Assembly shows XOR instruction xor ebx 10h in Stream UID: 00000000-00001400-28677-894-00AE73A5 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00001400-28677-901-00AE6BDB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001400-28677-1004-00A8E40A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001400-28677-1004-00A8E40A Assembly shows XOR instruction xor al byte ptr [ebp-02h] in Stream UID: 00000000-00001400-28677-1125-00A9807E Assembly shows XOR instruction xor byte ptr [ecx+edx+24h] al in Stream UID: 00000000-00001400-28677-1125-00A9807E Assembly shows XOR instruction xor eax 08h in Stream UID: 00000000-00001400-28677-1170-00AC2CCE Assembly shows XOR instruction xor ecx 49656E69h in Stream UID: 00000000-00001400-28677-1249-00A8885B Assembly shows XOR instruction xor eax 6C65746Eh in Stream UID: 00000000-00001400-28677-1249-00A8885B Assembly shows XOR instruction xor eax 756E6547h in Stream UID: 00000000-00001400-28677-1249-00A8885B28:T50e,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to performs encryption on the data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption29:Tf6d,Found XOR loop in file "RegAsm.exe" at offset 61346; code bytes = 30d0 Found XOR loop in file "RegAsm.exe" at offset 13430; code bytes = 30040e Found XOR loop in file "RegAsm.exe" at offset 13460; code bytes = 30040e Found XOR loop in file "RegAsm.exe" at offset 10181; code bytes = 8030 Found XOR loop in file "RegAsm.exe" at offset 25425; code bytes = 8030 Found XOR loop in file "RegAsm.exe" at offset 26100; code bytes = 8030 Found XOR loop in file "RegAsm.exe" at offset 28453; code bytes = 8030 Found XOR loop in file "RegAsm.exe" at offset 44718; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 410908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 553502; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 588132; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 616985; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 620594; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 765346; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 799681; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 885968; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 990393; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1411128; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 430509; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 456147; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 568770; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 590969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 682908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 722586; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 727138; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 755782; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 811881; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 868706; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 875909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1017670; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1045421; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1221330; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1284846; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1316786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 398642; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 447315; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 474649; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 517990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 773816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 773920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 798775; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 808326; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 824833; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 827736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 839846; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 848858; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 858912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1126589; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1133712; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1165217; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1197746; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1283504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1359124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1428953; code bytes = 80302a:T1f54,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600ecaccc7614dc12006d824b777cea2f0004010000 (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000320039003700360030003100330031006300310034003100320066003300350062003100380063003900320061006100630063003200390039003800380033002e00650078006500000000000000000000000000000000000000000000000000000000000000ff2bca776a58d277d8eb3476ac012a0000002a00000000000000000014009800ff0100000000000000000000000000000000000015009300ff0100000000000000000000606f2a0000000000200000000000000000000000a8eb2d00506c2a00706d2a0038f12f0018712a0000000000b0c612000000000030c81200 (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000064e4ed0170e4ed0138e6ed0192e0556ead746719feffffffb8e5ed0116bc546e8bc670cf01000000ece4ed01b8e5ed0120bc546e0600000000002e6b010000002fbc546e2a000000060000008bc670cf01000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4e5ed01000000008e00000044e6ed01feffffffcce5ed01cf00cb77d600cb77927a2d768e0000004700000044e6ed0100000000a0e5ed010000000008e6ed0195e1c67746990a00feffffffd600cb772f7bb875010000004600300d167bb8758dc73277 (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000a8513400aceeed010464ca7738012a00e063ca77f2712d760000000000002a00b05134006dd18e778ccf32776caeb07700000000000000000802000048633400302f2a000100000000002a0050012a000c000000b0513400302f2a000200000218000000946500f1820000000000000000000000030000004ceeed01820000007f07000000000000946500f102000000c07596774863340000000000c075967768eeed0140302a0000000000302f2a00c0eeed01ff2bca77aa712d767400000004022a0000002a003300c20001000000000000001000000000000101cceded01 (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003912) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003e0018000000aa0000000000000000000000b0eb4100586b3e00c06c3e00686c440070773e006100730044d12c00690073004cde2c00686c4400e9e9ca77686c440000000000aa00000070d22c00a8d62c0000000000000000000000000000000000000000000000000000000000000000001c5cc97760d8b875ffffffff1700000020d22c00240000000300000010d72c003cdc2c00a8d62c00860000004cd22c0096edca778a6c4400a06aa0758600000070d22c00a8d62c000000000086008800a06aa07570d22c00916ca0758a6c4400a06aa075a06aa075e0d62c0002020000 (UID: 00000000-00002164) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002164) "tasklist.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002464) "tasklist.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002464)2b:Tf0e,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb347638f12f0000f0fd7f9a5ccb7700e0fd7ff4c7120044f0fd7f00000000400000003f0000001e00000000f0fd7fe8c71200c15ccb776082d2771e00000000f0fd7f9a5ccb7700e0fd7f0cc812005789ca778083d2771317b975d8eb3476 (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003912) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000010000000100000000000000000000007900000065006d0000000000000000000000000000000000010000002f000000000000000000000065007800650000007400680015000015d3f900000000000000633f000000000000000000000000000000000000000000 (UID: 00000000-00001212) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000b2f4ca772747ea77bcea2b0000004372000043720000000000000000f0000000f00043720000000028ea2b0000000000bceb2b0000000000010000008cea2b0040f5ca77000000000000000078ea2b00 (UID: 00000000-00001212) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000880000000000000010e22b00459d3d760000190000000000800000000200000000002c00dc1a7c6c24e22b00 (UID: 00000000-00001212) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100006900630072006f0073006f00660074002000530069006c007600650072006c0069006700680074005c00780061007000610075007400680065006e007400690063006f00640065007300690070002e0064006c006c002e0032002e004d0061006e006900660065007300740000000000 (UID: 00000000-00001212) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001212) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f01a736c08000000c41a736cd9a36dec02000000d41c736c00002c00e616736c086e1900f86d1900e0d22b00d0f0746ca0d32b0053af746c056a3580feffffffc41a736c421a736ce616736c34d32b00d91b736ce616736c67c13d76ae05bc757457bc750000000000000000cc92b875 (UID: 00000000-00001212) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000600000001000000b11d00000200000053657276696365205061636b20310000f01a736c08000000c41a736cd9a36dec02000000d41c736c00002c00020000000000000088000000e0d22b0020d32b00459d3d760000190000000000800000000200000000002c009813776c34d32b00 (UID: 00000000-00001212) "RegAsm.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb3476c8214e0400f0fd7f9a5ccb7700e0fd7f84ad2b0044f0fd7f00000000400000003f0000002f00000000f0fd7f78ad2b00c15ccb776082d2772f00000000f0fd7f9a5ccb7700e0fd7f9cad2b005789ca778083d2771317b975d8eb3476 (UID: 00000000-00001212)2c:T60a,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tasklist.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Christmas.pif" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Christmas.pif" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "RegAsm.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2d:T63a,GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-1126-00A999D2 GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-1345-00AB88CD GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-1346-00AB8D89 GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-1347-00AB8E89 GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-1348-00AB8EBD GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-1349-00AB8E20 GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-1350-00AB8ACA GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-1351-00AB8CC7 GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-1352-00AB8D28 GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-1355-00AB9274 OpenProcessToken@ADVAPI32.DLL at 00000000-00001400-28677-1357-00AB9330 GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-1359-00AB94D9 GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-1360-00AB9431 OpenProcessToken@ADVAPI32.DLL at 00000000-00001400-28677-1363-00AB91CF GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-1364-00AB954A OpenProcess@KERNEL32.DLL at 00000000-00001400-28677-1384-00AC1BDD OpenProcess@KERNEL32.DLL at 00000000-00001400-28677-1592-00AC59A4 OpenProcess@KERNEL32.DLL at 00000000-00001400-28677-2008-00ADF01C OpenProcess@KERNEL32.DLL at 00000000-00001400-28677-2010-00ADF23E OpenProcess@KERNEL32.DLL at 00000000-00001400-28677-2013-00ADF6E8 OpenProcess@KERNEL32.DLL at 00000000-00001400-28677-2016-00ADF856 GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-2445-00A87E83 GetProcessHeap@KERNEL32.DLL at 00000000-00001400-28677-2457-00A88DAC2e:T4a7,"RegAsm.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\827243\RegAsm.exe" at 00000000-00001212-0000010C-12275932 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00001212-0000010C-30822708 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00001212-0000010C-30830262 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00001212-0000010C-32919301 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00001212-0000010C-32926294 "RegAsm.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001212-0000010C-340162712f:T505,"RegAsm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "RegAsm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "RegAsm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "RegAsm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "RegAsm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "RegAsm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "RegAsm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE"; Key: "BLOB") "RegAsm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419"; Key: "BLOB") "RegAsm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656"; Key: "BLOB") "RegAsm.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072"; Key: "BLOB")30:T59d,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00003912) "RegAsm.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001212) "RegAsm.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001212) "RegAsm.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001212)31:T4f1,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /k move Jose Jose.bat & Jose.bat & exit" - (UID: 00000000-00003912) "cmd.exe" called "CreateProcessW" with parameter "tasklist" - (UID: 00000000-00002164) "cmd.exe" called "CreateProcessW" with parameter "findstr /I "wrsa opssvc"" - (UID: 00000000-00002164) "cmd.exe" called "CreateProcessW" with parameter "findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"" - (UID: 00000000-00002164) "cmd.exe" called "CreateProcessW" with parameter "cmd /c md 827243" - (UID: 00000000-00002164) "cmd.exe" called "CreateProcessW" with parameter "findstr /V "CATCIRWILLIAMSPROFESSION" Burlington" - (UID: 00000000-00002164) "cmd.exe" called "CreateProcessW" with parameter "cmd /c copy /b ..\Cameras + ..\Affect + ..\Amenities + ..\Ja + ..\Los + ..\Birthday + ..\Eliminate + ..\Melissa C" - (UID: 00000000-00002164) "cmd.exe" called "CreateProcessW" with parameter "Christmas.pif C" - (UID: 00000000-00002164) "cmd.exe" called "CreateProcessW" with parameter "choice /d y /t 5" - (UID: 00000000-00002164) "Christmas.pif" called "CreateProcessW" with parameter "%TEMP%\827243\RegAsm.exe" - (UID: 00000000-00001400)32:T453a,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadLibrary" with a parameter SHFOLDER (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003912) "cmd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002164) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002464) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002464) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00002464) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\tasklist.exe (UID: 00000000-00002464) "tasklist.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002464) "tasklist.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002464) "tasklist.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002464) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00006128) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00006128) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00006128) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\tasklist.exe (UID: 00000000-00006128) "tasklist.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006128) "tasklist.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00006128) "tasklist.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00006128) "Christmas.pif" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\psapi.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter imageres.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001400) "Christmas.pif" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001400) "RegAsm.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\crypt32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\wshext.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Microsoft Silverlight\xapauthenticodesip.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dynamic\b7ad5353ae4f44df28ce7ebc9a8a752a\System.Dynamic.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001212) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00001212)33:Ted41,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003912) "cmd.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00002164) "cmd.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00002164) "cmd.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00002164) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00002464) "tasklist.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00002464) "findstr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003876) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00006128) "tasklist.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00006128) "findstr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006124) "findstr.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006124) "findstr.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006124) "findstr.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006124) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004360) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004360) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004360) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004360) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00004360) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00004360) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00004360) "Christmas.pif" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter NtReadVirtualMemory (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter MessageBoxIndirectW (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetThemeTransitionDuration (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter BeginBufferedAnimation (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter EndBufferedAnimation (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter RtlGetCompressionWorkSpaceSize (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter RtlDecompressFragment (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter VirtualAllocExNuma (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter NtResumeThread (UID: 00000000-00001400) "Christmas.pif" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001400) "choice.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004388) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter MsiSIPIsMyTypeOfFile (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter IsFileSupportedName (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter PsIsMyFileType (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter XAP_IsFileSupportedName (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter PFXImportCertStore (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptEnumProvidersW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetProfileType (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetSidIdentifierAuthority (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptProtectData (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SystemFunction040 (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SystemFunction041 (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertControlStore (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertControlStoreW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterGPNotificationInternal (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertFindCertificateInStoreW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertAddCertificateContextToStore (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CertAddCertificateContextToStoreW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SxsLookupClrGuid (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter IsValidLinkInfo (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter PropVariantToGUID (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter PSGetNameFromPropertyKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter PSStringFromPropertyKey (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter InitVariantFromBuffer (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00001212) "RegAsm.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001212)34:T544,Sleep@KERNEL32.DLL at 00000000-00001400-28677-66-00A8A362 Sleep@KERNEL32.DLL at 00000000-00001400-28677-132-00AA44DF Sleep@KERNEL32.DLL at 00000000-00001400-28677-578-00AC2BAF Sleep@KERNEL32.DLL at 00000000-00001400-28677-636-00AC57FF WaitForSingleObject@KERNEL32.DLL at 00000000-00001400-28677-692-00AC77EB WaitForSingleObject@KERNEL32.DLL at 00000000-00001400-28677-696-00AD2E47 SetTimer at 00000000-00001400-28677-858-00A62BA9 Sleep@KERNEL32.DLL at 00000000-00001400-28677-1058-00A6E00D Sleep@KERNEL32.DLL at 00000000-00001400-28677-1062-00A6E36D SetTimer at 00000000-00001400-28677-1168-00A74D83 Sleep@KERNEL32.DLL at 00000000-00001400-28677-1170-00AC2CCE SetTimer at 00000000-00001400-28677-1174-00A75B29 Sleep@KERNEL32.DLL at 00000000-00001400-28677-1330-00AB729E WaitForSingleObject@KERNEL32.DLL at 00000000-00001400-28677-1364-00AB954A Sleep@KERNEL32.DLL at 00000000-00001400-28677-1366-00AB95D7 Sleep@KERNEL32.DLL at 00000000-00001400-28677-1391-00ABA226 SetTimer at 00000000-00001400-28677-1448-00ABCB97 Sleep@KERNEL32.DLL at 00000000-00001400-28677-1520-00AC1941 WaitForSingleObject@KERNEL32.DLL at 00000000-00001400-28677-1581-00AC504E Sleep@KERNEL32.DLL at 00000000-00001400-28677-1586-00AC5530 Sleep@KERNEL32.DLL at 00000000-00001400-28677-1637-00ACFA36 Sleep@KERNEL32.DLL at 00000000-00001400-28677-1647-00ACB80035:Tabf,"RegAsm.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135]36:T13de,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001212.00000000.80556.00070000.00000040.mdmp "Software\Valve\SteamLogin Data" in Source: 00000000-00001212.00000000.80556.00070000.00000040.mdmp "HKEY_CLASSES_ROOT\Record\" in Source: 00000000-00001212.00000000.80556.00832000.00000020.mdmp "HKEY_CLASSES_ROOT\" in Source: 00000000-00001212.00000000.80556.00832000.00000020.mdmp "HKEY_CLASSES_ROOT\CLSID\" in Source: 00000000-00001212.00000000.80556.00832000.00000020.mdmp "HKEY_CLASSES_ROOT\TypeLib\" in Source: 00000000-00001212.00000000.80556.00832000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001212.00000001.82347.00390000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001212.00000001.82347.00390000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001212.00000001.82347.01F00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001212.00000001.82347.01F00000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00001212.00000001.82347.01F00000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00001212.00000001.82347.01F00000.00000004.mdmp "SOFTWARE\Microsoft\Windows " in Source: 00000000-00001212.00000001.82347.01F00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001212.00000001.82347.01F00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001212.00000001.82347.01F00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00001212.00000001.82347.01F00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00001212.00000001.82347.01F00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00001212.00000001.82347.01F00000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001212.00000002.84272.00390000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001212.00000002.84272.00390000.00000004.mdmp "Read7HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa" in Source: 00000000-00001212.00000002.84272.00E10000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001212.00000002.84272.01F00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001212.00000002.84272.01F00000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00001212.00000002.84272.01F00000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00001212.00000002.84272.01F00000.00000004.mdmp "SOFTWARE\Microsoft\Windows " in Source: 00000000-00001212.00000002.84272.01F00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001212.00000002.84272.01F00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001212.00000002.84272.01F00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00001212.00000002.84272.01F00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00001212.00000002.84272.01F00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00001212.00000002.84272.01F00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00001212.00000002.84272.01F00000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00001400.00000002.80623.00AF0000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00001400.00000002.80623.00AF0000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00001400.00000002.80623.00AF0000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003912.00000000.76443.002A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003912.00000000.76443.002A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003912.00000000.76443.00408000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003912.00000001.76486.002A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003912.00000001.76486.002A0000.00000004.mdmp37:T3098,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ca80000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 749d0000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "SHFOLDER" at base 73800000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "OLE32.DLL" at base 76480000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "KERNEL32.DLL" at base 778a0000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "COMCTL32.DLL" at base 74a50000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "OLEAUT32.DLL" at base 75ed0000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "ADVAPI32.DLL" at base 777f0000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 778a0000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "SETUPAPI.DLL" at base 766a0000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "RPCRT4.DLL" at base 77980000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "CLBCATQ.DLL" at base 77760000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 746a0000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "NTMARTA.DLL" at base 74fc0000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77500000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "PROFAPI.DLL" at base 75b70000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "SHELL32.DLL" at base 76850000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "PROPSYS.DLL" at base 746a0000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "APPHELP.DLL" at base 75a00000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6b2e0000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75bf0000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77b00000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "SECUR32.DLL" at base 75890000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75c10000 "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75a00000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 777f0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 778a0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75a00000 "tasklist.exe" loaded module "ADVAPI32.DLL" at base 777f0000 "tasklist.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77500000 "tasklist.exe" loaded module "CLBCATQ.DLL" at base 77760000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 778a0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f720000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WINSTA.DLL" at base 75ac0000 "tasklist.exe" loaded module "KERNEL32.DLL" at base 778a0000 "tasklist.exe" loaded module "CRYPTSP.DLL" at base 75560000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 752f0000 "tasklist.exe" loaded module "CRYPTBASE.DLL" at base 75a50000 "tasklist.exe" loaded module "RPCRTREMOTE.DLL" at base 75af0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72790000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72590000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6e8a0000 "tasklist.exe" loaded module "RPCRT4.DLL" at base 77980000 "tasklist.exe" loaded module "OLEAUT32.DLL" at base 75ed0000 "findstr.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ca80000 "Christmas.pif" loaded module "DWMAPI.DLL" at base 74280000 "Christmas.pif" loaded module "COMCTL32.DLL" at base 74a50000 "Christmas.pif" loaded module "KERNEL32.DLL" at base 778a0000 "Christmas.pif" loaded module "UXTHEME.DLL" at base 749d0000 "Christmas.pif" loaded module "IMM32.DLL" at base 765e0000 "Christmas.pif" loaded module "COMCTL32" at base 74a50000 "Christmas.pif" loaded module "SHELL32.DLL" at base 76850000 "Christmas.pif" loaded module "OLE32.DLL" at base 76480000 "Christmas.pif" loaded module "PSAPI.DLL" at base 76840000 "Christmas.pif" loaded module "MSVCRT.DLL" at base 763d0000 "RegAsm.exe" loaded module "SHLWAPI.DLL" at base 774a0000 "RegAsm.exe" loaded module "VERSION.DLL" at base 74ff0000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71cb0000 "RegAsm.exe" loaded module "KERNEL32" at base 778a0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 647d0000 "RegAsm.exe" loaded module "USER32.DLL" at base 76220000 "RegAsm.exe" loaded module "MSCOREE.DLL" at base 6c0e0000 "RegAsm.exe" loaded module "PSAPI.DLL" at base 76840000 "RegAsm.exe" loaded module "RPCRT4.DLL" at base 77980000 "RegAsm.exe" loaded module "KERNEL32.DLL" at base 778a0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 633c0000 "RegAsm.exe" loaded module "OLE32.DLL" at base 76480000 "RegAsm.exe" loaded module "CRYPTBASE.DLL" at base 75a50000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 749d0000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6d5e0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6c910000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62960000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 6a110000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61af0000 "RegAsm.exe" loaded module "ADVAPI32.DLL" at base 777f0000 "RegAsm.exe" loaded module "UXTHEME.DLL" at base 749d0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 612d0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6af10000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60b50000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d5c0000 "RegAsm.exe" loaded module "NTDLL.DLL" at base 77c50000 "RegAsm.exe" loaded module "SHELL32.DLL" at base 76850000 "RegAsm.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77500000 "RegAsm.exe" loaded module "PROFAPI.DLL" at base 75b70000 "RegAsm.exe" loaded module "BCRYPT.DLL" at base 75670000 "RegAsm.exe" loaded module "CRYPTSP.DLL" at base 75560000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 752f0000 "RegAsm.exe" loaded module "IMM32.DLL" at base 765e0000 "RegAsm.exe" loaded module "COMCTL32.DLL" at base 72430000 "RegAsm.exe" loaded module "GDI32.DLL" at base 77a30000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 65440000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5ff10000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5eb20000 "RegAsm.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 6a460000 "RegAsm.exe" loaded module "DWRITE.DLL" at base 6a9a0000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75b80000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5e990000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 6a850000 "RegAsm.exe" loaded module "CRYPT32.DLL" at base 75c80000 "RegAsm.exe" loaded module "MSISIP.DLL" at base 6e510000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75c80000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 6c7c0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6cb20000 "RegAsm.exe" loaded module "%PROGRAMFILES%\MICROSOFT SILVERLIGHT\XAPAUTHENTICODESIP.DLL" at base 6c900000 "RegAsm.exe" loaded module "NCRYPT.DLL" at base 75690000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75230000 "RegAsm.exe" loaded module "USERENV.DLL" at base 75c20000 "RegAsm.exe" loaded module "GPAPI.DLL" at base 75130000 "RegAsm.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 77500000 "RegAsm.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 77500000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 5e7f0000 "RegAsm.exe" loaded module "SXS.DLL" at base 75a60000 "RegAsm.exe" loaded module "CLBCATQ.DLL" at base 77760000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 6c770000 "RegAsm.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77500000 "RegAsm.exe" loaded module "RPCRTREMOTE.DLL" at base 75af0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76850000 "RegAsm.exe" loaded module "COMCTL32.DLL" at base 74a50000 "RegAsm.exe" loaded module "OLEAUT32.DLL" at base 75ed0000 "RegAsm.exe" loaded module "LINKINFO.DLL" at base 71920000 "RegAsm.exe" loaded module "PROPSYS.DLL" at base 746a0000 "RegAsm.exe" loaded module "SETUPAPI.DLL" at base 766a0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 746a0000 "RegAsm.exe" loaded module "NTMARTA.DLL" at base 74fc0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DYNAMIC\B7AD5353AE4F44DF28CE7EBC9A8A752A\SYSTEM.DYNAMIC.NI.DLL" at base 6a7e0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5e510000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5e200000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6b2b0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 6a3a0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6a350000 "RegAsm.exe" loaded module "WS2_32.DLL" at base 75e90000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75520000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 75080000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75510000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 68d9000038:T16b1,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "tasklist.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "tasklist.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS") "RegAsm.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\INPROCSERVER32") "RegAsm.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}") "RegAsm.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "RegAsm.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")39:Tb5a,Process "cmd.exe" (UID: 00000000-00002164) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "cmd.exe" (UID: 00000000-00002164) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "tasklist.exe" (UID: 00000000-00002464) was launched with new environment variables: "Parenting="Z", Configuration="n", Disease="E", Front="p", Product="W", Texts="t", Extract="y", Grass="A", Responsibility=".", Corps="c", Minutes="k", Encourages="z", Bbs="3", Passing="g", Efficiency="B", Licence="9", Ids="M", Alike="v", Warming="I", Hourly="G", Crops="w", Mileage="6", Fox="H", Editors="C", Principles="Y", Becomes="N", Um="d", Acrylic="T", A="h", Mn="S", Haven="1", Nipple="J", Generic="4", Increasing="L", PROMPT="$P$G", Scales="s", Monitor="f", Larry="5", Communication="/", Delivers="a", Post="Q", Owns="x", Request="V", SkOrIcqaNlMgFTYPJpBBlpchkiTtBGA="Christmas.pif", Tions="e", Guidance="U", Jazz="u", Voice="i"" Process "tasklist.exe" (UID: 00000000-00006128) was launched with new environment variables: "Marathon="827243"" Process "Christmas.pif" (UID: 00000000-00001400) was launched with missing environment variables: "Parenting, Configuration, Disease, Front, Product, Texts, Extract, Grass, Responsibility, Corps, Minutes, Encourages, Bbs, Passing, Efficiency, Licence, Ids, Alike, Warming, Hourly, Crops, Mileage, Fox, Editors, Principles, Becomes, Um, Marathon, Acrylic, A, Mn, Haven, Nipple, Generic, Increasing, PROMPT, Scales, Monitor, Larry, Communication, Delivers, Post, Owns, Request, SkOrIcqaNlMgFTYPJpBBlpchkiTtBGA, Tions, Guidance, Jazz, Voice" Process "choice.exe" (UID: 00000000-00004388) was launched with new environment variables: "Parenting="Z", Configuration="n", Disease="E", Front="p", Product="W", Texts="t", Extract="y", Grass="A", Responsibility=".", Corps="c", Minutes="k", Encourages="z", Bbs="3", Passing="g", Efficiency="B", Licence="9", Ids="M", Alike="v", Warming="I", Hourly="G", Crops="w", Mileage="6", Fox="H", Editors="C", Principles="Y", Becomes="N", Um="d", Marathon="827243", Acrylic="T", A="h", Mn="S", Haven="1", Nipple="J", Generic="4", Increasing="L", PROMPT="$P$G", Scales="s", Monitor="f", Larry="5", Communication="/", Delivers="a", Post="Q", Owns="x", Request="V", SkOrIcqaNlMgFTYPJpBBlpchkiTtBGA="Christmas.pif", Tions="e", Guidance="U", Jazz="u", Voice="i"" Process "RegAsm.exe" (UID: 00000000-00001212) was launched with missing environment variables: "Parenting, Configuration, Disease, Front, Product, Texts, Extract, Grass, Responsibility, Corps, Minutes, Encourages, Bbs, Passing, Efficiency, Licence, Ids, Alike, Warming, Hourly, Crops, Mileage, Fox, Editors, Principles, Becomes, Um, Marathon, Acrylic, A, Mn, Haven, Nipple, Generic, Increasing, PROMPT, Scales, Monitor, Larry, Communication, Delivers, Post, Owns, Request, SkOrIcqaNlMgFTYPJpBBlpchkiTtBGA, Tions, Guidance, Jazz, Voice"3a:T5ae,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "Christmas.pif" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Christmas.pif" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Christmas.pif" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "RegAsm.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "RegAsm.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "RegAsm.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")3b:Tffc,Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003912-00000C2B-198108688] Observed system executable string:"%WINDIR%\system32\Winsta.dll" [Source: 00000000-00002464-00000C2B-210410727] Observed system executable string:"%WINDIR%\system32\psapi.dll" [Source: 00000000-00001400-00000C2B-233743446] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00001400-00000C2B-241267815] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00001400-00000C2B-241556790] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001212-00000C2B-267967728] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001212-00000C2B-270963028] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001212-00000C2B-271312044] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001212-00000C2B-271766968] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001212-00000C2B-272040387] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001212-00000C2B-273408567] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001212-00000C2B-273592459] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00001212-00000C2B-273763902] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00001212-00000C2B-273966797] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00001212-00000C2B-274487243] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001212-00000C2B-274994525] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00001212-00000C2B-275315561] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00001212-00000C2B-275508294] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00001212-00000C2B-275670614] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001212-00000C2B-276493237] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00001212-00000C2B-278229734] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00001212-00000C2B-278444757] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00001212-00000C2B-278662310] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" [Source: 00000000-00001212-00000C2B-279062298] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" [Source: 00000000-00001212-00000C2B-279569244]3c:T413,Spawned process "cmd.exe" with commandline "/k move Jose Jose.bat & Jose.bat & exit" (UID: 00000000-00002164) Spawned process "tasklist.exe" (UID: 00000000-00002464) Spawned process "findstr.exe" with commandline "findstr /I "wrsa opssvc"" (UID: 00000000-00003876) Spawned process "tasklist.exe" (UID: 00000000-00006128) Spawned process "findstr.exe" with commandline "findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"" (UID: 00000000-00006124) Spawned process "cmd.exe" with commandline "cmd /c md 827243" (UID: 00000000-00004208) Spawned process "findstr.exe" with commandline "findstr /V "CATCIRWILLIAMSPROFESSION" Burlington" (UID: 00000000-00004356) Spawned process "cmd.exe" with commandline "cmd /c copy /b ..\\Cameras + ..\\Affect + ..\\Amenities + ..\\J ..." (UID: 00000000-00004360) Spawned process "Christmas.pif" with commandline "C" (UID: 00000000-00001400) Spawned process "choice.exe" with commandline "choice /d y /t 5" (UID: 00000000-00004388) Spawned process "RegAsm.exe" (UID: 00000000-00001212)3d:T413,Spawned process "cmd.exe" with commandline "/k move Jose Jose.bat & Jose.bat & exit" (UID: 00000000-00002164) Spawned process "tasklist.exe" (UID: 00000000-00002464) Spawned process "findstr.exe" with commandline "findstr /I "wrsa opssvc"" (UID: 00000000-00003876) Spawned process "tasklist.exe" (UID: 00000000-00006128) Spawned process "findstr.exe" with commandline "findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"" (UID: 00000000-00006124) Spawned process "cmd.exe" with commandline "cmd /c md 827243" (UID: 00000000-00004208) Spawned process "findstr.exe" with commandline "findstr /V "CATCIRWILLIAMSPROFESSION" Burlington" (UID: 00000000-00004356) Spawned process "cmd.exe" with commandline "cmd /c copy /b ..\\Cameras + ..\\Affect + ..\\Amenities + ..\\J ..." (UID: 00000000-00004360) Spawned process "Christmas.pif" with commandline "C" (UID: 00000000-00001400) Spawned process "choice.exe" with commandline "choice /d y /t 5" (UID: 00000000-00004388) Spawned process "RegAsm.exe" (UID: 00000000-00001212)3e:T98a,"RegAsm.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\827243\RegAsm.exe]- [targetUID: 00000000-00001400] "Google Chrome.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Has command line arguments Icon number=0 Unicoded HasExpIcon "%ProgramFiles%\Google\Chrome\Application\chrome.exe" KnownFolderID 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E Archive ctime=Fri Mar 8 16:25:46 2024 atime=Fri Mar 8 16:25:46 2024 mtime=Tue Jan 24 00:06:23 2023 length=2465048 window=normal IDListSize 0x020f Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files\Google\Chrome\Application\chrome.exe""- Location: [%PUBLIC%\Desktop\Google Chrome.lnk]- [targetUID: 00000000-00001212] "Bdsm" has type "data"- Location: [%TEMP%\Bdsm]- [targetUID: 00000000-00003912] "C" has type "data"- Location: [%TEMP%\827243\C]- [targetUID: 00000000-00004360] "Affect" has type "OpenPGP Public Key"- Location: [%TEMP%\Affect]- [targetUID: 00000000-00003912] "Birthday" has type "data"- Location: [%TEMP%\Birthday]- [targetUID: 00000000-00003912] "Los" has type "data"- Location: [%TEMP%\Los]- [targetUID: 00000000-00003912] "Cameras" has type "data"- Location: [%TEMP%\Cameras]- [targetUID: 00000000-00003912] "Ja" has type "data"- Location: [%TEMP%\Ja]- [targetUID: 00000000-00003912] "Amenities" has type "data"- Location: [%TEMP%\Amenities]- [targetUID: 00000000-00003912] "Eliminate" has type "data"- Location: [%TEMP%\Eliminate]- [targetUID: 00000000-00003912] "Melissa" has type "data"- Location: [%TEMP%\Melissa]- [targetUID: 00000000-00003912] "Jose" has type "ASCII text with very long lines (969) with CRLF line terminators"- Location: [%TEMP%\Jose]- [targetUID: 00000000-00003912] "Tmp7178.tmp" has type "data"- Location: [%TEMP%\Tmp7178.tmp]- [targetUID: 00000000-00001212] "76b53b3ec448f7ccdda2063b15d2bfc3_733c94c5-cebb-4f98-a75f-22a797d1d50b" has type "data"- Location: [%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2092356043-4041700817-663127204-1001\76b53b3ec448f7ccdda2063b15d2bfc3_733c94c5-cebb-4f98-a75f-22a797d1d50b]- [targetUID: 00000000-00001212] "Burlington" has type "data"- Location: [%TEMP%\Burlington]- [targetUID: 00000000-00003912] "Tmp6BCC.tmp" has type "data"- Location: [%TEMP%\Tmp6BCC.tmp]- [targetUID: 00000000-00001212]3f:Tfcf,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: ""; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "")40:T1670,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: "SUPPRESSIONPOLICY"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: "SUPPRESSIONPOLICY"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: "SUPPRESSIONPOLICY"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: "SUPPRESSIONPOLICY"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: "SUPPRESSIONPOLICY"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "QUERYFORINFOTIP"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "HIDEINWEBVIEW"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "HIDEONDESKTOPPERUSER"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "WANTSALIASEDNOTIFICATIONS"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "WANTSUNIVERSALDELEGATE"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "NOFILEFOLDERJUNCTION"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "PINTONAMESPACETREE"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "HASNAVIGATIONENUM"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{208D2C60-3AEA-1069-A2D7-08002B30309D}"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "")41:T48d,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Contains ability to retrieve type of COM object Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to query volume size42:Tb6d,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.Local\" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\COMCTL32.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\VERSION.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\Windows\system32\rpcss.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\CRYPTBASE.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "\Device\KsecDD" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\Windows\system32\uxtheme.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\FLTLIB.DLL" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\MSVCP140.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\VCRUNTIME140.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to touch file "C:\ucrtbase.DLL"43:T44b,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched file "C:\Windows\ChildWaterproof" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched file "C:\Windows\HispanicSteve" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched file "C:\Windows\FairlyIntroductory" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched file "C:\Windows\MateFeb" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched file "C:\Windows\OopsGuitars" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched file "C:\Windows\ArtificialAlbania" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "RegAsm.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "RegAsm.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"44:Td48,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\VERSION.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\FLTLIB.DLL" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\MSVCP140.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\ucrtbase.DLL" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL"45:T5ef,file/memory contains long string with (Indicator: "HttpWebRequest"; File: "RegAsm.exe") Found string "SystemNetHttpWebRequest" (Indicator: "HttpWebRequest"; File: "00000000-00001212.00000000.80556.00832000.00000020.mdmp") Found string "SystemNetHttpWebRequest" (Indicator: "HttpWebRequest"; Source: "00000000-00001212.00000000.80556.00832000.00000020.mdmp") Found string "HttpWebRequests Created/Sec" (Indicator: "HttpWebRequest"; Source: "00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found string "HttpWebRequests Average Lifetime" (Indicator: "HttpWebRequest"; Source: "00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found string "HttpWebRequests Average Lifetime Base" (Indicator: "HttpWebRequest"; Source: "00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found string "HttpWebRequests Queued/Sec" (Indicator: "HttpWebRequest"; Source: "00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found string "HttpWebRequests Average Queue Time" (Indicator: "HttpWebRequest"; Source: "00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found string "HttpWebRequests Average Queue Time Base" (Indicator: "HttpWebRequest"; Source: "00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found string "HttpWebRequests Aborted/Sec" (Indicator: "HttpWebRequest"; Source: "00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found string "HttpWebRequests Failed/Sec" (Indicator: "HttpWebRequest"; Source: "00000000-00001212.00000002.84272.01F00000.00000004.mdmp")46:T6c4,Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00001212.00000001.82347.00390000.00000004.mdmp, 00000000-00001212.00000002.84272.00390000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00001212.00000001.82347.00390000.00000004.mdmp, 00000000-00001212.00000002.84272.00390000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001212.00000001.82347.00E30000.00000002.mdmp, 00000000-00001212.00000002.84272.00E30000.00000002.mdmp") file/memory contains long string with (Indicator: " connect "; Source: "00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to API "Could not connect to {0}. The connection attempt lasted for a time span of {3}. TCP error code {1}: {2}. 089" (Indicator: " connect "; Source: "00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to API "Could not connect to {0}. The connection attempt lasted for a time span of {3}. TCP error code {1}: {2}." (Indicator: " connect "; Source: "00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001400.00000000.77548.010C0000.00000002.mdmp, 00000000-00001400.00000001.79470.010C0000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003912.00000000.76443.00CA0000.00000002.mdmp")47:T7ec,"0.0.0.0" "255.255.255.255" "4.0.0.0" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" "12.9.1.22" "15.0.0.0" Potential IP "217.65.2.14" found in string "-proxy-server="217.65.2.14:3333"" "1.1.21.1" "192.168.0.2" Potential IP "4.0.0.0" found in string "m.Windows.Forms,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "ternals,4.0.0.0,,31b" Potential IP "4.0.0.0" found in string "Services,4.0.0.0,,31" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />", Potential IP "4.0.0.0" found in string "sion=4.0.0.0 Culture=neutral PublicKeyToken=b0", Potential IP "4.0.0.0" found in string "4.0.0.0 Cul", Potential IP "2.5.29.37" found in string "%2.5.29.37", "2.5.29.19", "2.5.29.15", "2.5.29.14", "2.5.29.10", "2.5.4.3", "2.5.29.1", Potential IP "2.5.29.35" found in string "#2.5.29.35", "2.5.29.37", Potential IP "217.65.2.14" found in string "--proxy-server="217.65.2.14:3333"", "185.215.113.67:21405", Potential IP "185.215.113.67" found in string "net.tcp://185.215.113.67:21405/", "185.215.113.67", Potential IP "4.0.0.0" found in string "System.ServiceModel 4.0.0.0", "2.5.29.31", "2.5.29.32", "2.5.29.16", Potential IP "4.0.0.0" found in string "=4.0.0.0 Cu", Potential IP "4.0.0.0" found in string "ion=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089", Potential IP "185.215.113.67" found in string "[185.215.113.67 21405]", Potential IP "185.215.113.67" found in string "A connection attempt failed because the connected party did not properly respond after a period of time or established connection failed because connected host has failed to respond 185.215.113.67:21405", Potential IP "185.215.113.67" found in string "ed connection failed because connected host has failed to respond 185.215.113.67:21405."48:T18ad,Found URL "http://user.configfile:.configfile://datadirectoryc:\users\hapubws\appdata\local\temp\827243\regasm.exe.configfile:///c:/users/hapubws/appdata/local/temp/827243/regasm.exec:/users/hapubws/appdata/local/temp/827243/regasm.exec:\users\hapubws\appdata\local\temp\827243\regasm.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?2.5.29.31" - Source: "00000000-00001212.00000001.82347.044B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00001212.00000001.82347.044B0000.00000004.mdmp") Found URL "http://lo" - Source: "00000000-00001212.00000001.82347.044B0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0" - Source: "00000000-00001212.00000001.82347.044B0000.00000004.mdmp") Found URL "http://crl.comodcom/aaacertificateservices.crl06/crl.comodo.net/aaacertificateservices.c0cate8221_0]1!ed_$/a*uwutt.1i$system.runtime.interopservices.expando.iexpando^lsigxzxlxlmemlmemlmemlmemjv(gkvw\v@4v0!n4vx!n4vh" - Source: "00000000-00001212.00000001.82347.044B0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\hapubws\appdata\local\temp\827243\regasm.exe.configfile:///c:/users/hapubws/appdata/local/temp/827243/regasm.exec:/users/hapubws/appdata/local/temp/827243/regasm.exec:\users\hapubws\appdata\local\temp\827243\regasm.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?2.5.29.31" - Source: "00000000-00001212.00000002.84272.044B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00001212.00000002.84272.044B0000.00000004.mdmp") Found URL "http://lo" - Source: "00000000-00001212.00000002.84272.044B0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0" - Source: "00000000-00001212.00000002.84272.044B0000.00000004.mdmp") Found URL "http://crl.comodcom/aaacertificateservices.crl06/crl.comodo.net/aaacertificateservices.c0cate8221_0]1!ed_$/a*uwutt.1i$system.runtime.interopservices.expando.iexpando^lsigxzxlxlmemlmemlmemlmemjv(gkvw\v@4v0!n4vx!n4vh" - Source: "00000000-00001212.00000002.84272.044B0000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3/filedescriptionautoit" - Source: "00000000-00001400.00000000.77548.00B29000.00000002.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00003912.00000000.76443.00408000.00000002.mdmp")49:T55c,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00001400.00000002.80623.00A61000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00001400.00000002.80623.00A61000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001212.00000001.82347.6C901000.00000020.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001212.00000001.82347.6C901000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp")4a:Tb2b,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "FindFirstFileW" with parameter SatelliteConsequences (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "FindFirstFileW" with parameter FocusEarning (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "FindFirstFileW" with parameter BootySolarisAttendanceWhichCarriersAccomplished (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "FindFirstFileW" with parameter SuperintendentBreakfastSpecifySicAgreesSites (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "FindFirstFileW" with parameter BarrierSuckingRelationshipsApplying (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "FindFirstFileW" with parameter %TEMP%\cmd.* (UID: 00000000-00003912) "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\cmd.* (UID: 00000000-00003912) "cmd.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\*.* (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter aaclient.dll (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter ACCTRES.dll (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter acledit.dll (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter aclui.dll (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter acmigration.dll (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter acppage.dll (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter acproxy.dll (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter ActionCenter.dll (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter ActionCenterCPL.dll (UID: 00000000-00002164) "cmd.exe" called "FindNextFileW" with parameter ActionQueue.dll (UID: 00000000-00002164)4b:T568,"Christmas.pif" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00001400) "Christmas.pif" called "Process32NextW with parameter System" (UID: 00000000-00001400) "Christmas.pif" called "Process32NextW with parameter smss.exe" (UID: 00000000-00001400) "Christmas.pif" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00001400) "Christmas.pif" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00001400) "Christmas.pif" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00001400) "Christmas.pif" called "Process32NextW with parameter services.exe" (UID: 00000000-00001400) "Christmas.pif" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00001400) "Christmas.pif" called "Process32NextW with parameter lsm.exe" (UID: 00000000-00001400) "Christmas.pif" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00001400) "Christmas.pif" called "Process32NextW with parameter taskhost.exe" (UID: 00000000-00001400) "Christmas.pif" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00001400) "Christmas.pif" called "Process32NextW with parameter explorer.exe" (UID: 00000000-00001400) "Christmas.pif" called "Process32NextW with parameter spoolsv.exe" (UID: 00000000-00001400) "Christmas.pif" called "Process32NextW with parameter WmiPrvSE.exe" (UID: 00000000-00001400)4c:Tdfa,Found string "FromBase64" (Indicator: "base64"; File: "00001212.000004BC.48438638.00070000.wprm") Found string "AesGcm256" (Indicator: "aes"; File: "00001212.000004BC.48438638.00070000.wprm") Found string "AesFastEngine" (Indicator: "aes"; File: "00001212.000004BC.48438638.00070000.wprm") Found string "FromBase64String" (Indicator: "base64"; File: "00001212.000004BC.48438638.00070000.wprm") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00001212.000004BC.48438638.00070000.wprm") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00001212.000004BC.48438638.00070000.wprm") Found string "base64str" (Indicator: "base64"; File: "00001212.000004BC.48438638.00070000.wprm") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00001212.000004BC.48438638.00070000.wprm") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00001212.000004BC.48438638.00070000.wprm") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00001212.000004BC.48438638.00070000.wprm") Found string "o AES init -" (Indicator: "aes"; File: "00001212.000004BC.48438638.00070000.wprm") Found string "nvalid parameter passed to AES init -" (Indicator: "aes"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") file/memory contains long string with (Indicator: "rsa2"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found string "AesGcm256" (Indicator: "aes"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found string "AesFastEngine" (Indicator: "aes"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found string "base64str" (Indicator: "base64"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found string "PQAeS~" (Indicator: "aes"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found string "P~AeS" (Indicator: "aes"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001212.00000001.82347.00390000.00000004.mdmp, 00000000-00001212.00000002.84272.00390000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001212.00000001.82347.00390000.00000004.mdmp, 00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.00390000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp")4d:T5f5,Found string "ZIndicates if the text in the edit control should appear as the default password character." (Indicator: "password"; File: "00001212.000004BC.48438638.00070000.wprm") Found string "ZIndicates if the text in the edit control should appear as the default password character." (Indicator: "password"; Source: "00000000-00001212.00000000.80556.00070000.00000040.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp")4e:Tc49,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001212.00000001.82347.00390000.00000004.mdmp, 00000000-00001212.00000002.84272.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001212.00000001.82347.00390000.00000004.mdmp, 00000000-00001212.00000002.84272.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001212.00000001.82347.00390000.00000004.mdmp, 00000000-00001212.00000002.84272.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001212.00000001.82347.00390000.00000004.mdmp, 00000000-00001212.00000002.84272.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001212.00000001.82347.00390000.00000004.mdmp, 00000000-00001212.00000002.84272.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001212.00000001.82347.00390000.00000004.mdmp, 00000000-00001212.00000002.84272.00390000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001212.00000001.82347.00390000.00000004.mdmp, 00000000-00001212.00000002.84272.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003912.00000000.76443.002A0000.00000004.mdmp, 00000000-00003912.00000001.76486.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003912.00000000.76443.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003912.00000000.76443.002A0000.00000004.mdmp, 00000000-00003912.00000001.76486.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003912.00000000.76443.002A0000.00000004.mdmp, 00000000-00003912.00000001.76486.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003912.00000000.76443.002A0000.00000004.mdmp, 00000000-00003912.00000001.76486.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003912.00000000.76443.002A0000.00000004.mdmp") Found string "\Windows\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003912.00000000.76443.00CA0000.00000002.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003912.00000001.76486.002A0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003912.00000001.76486.002A0000.00000004.mdmp")4f:T84d,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001400.00000002.80623.00AF0000.00000002.mdmp")50:T91a,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "tasklist.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "Christmas.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Christmas.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "Christmas.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "Christmas.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "Christmas.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "Christmas.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "Christmas.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "")51:Tb28,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "RegAsm.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\F1A578C4CB5DE79A370893983FD4DA8B67B2B064"; Key: "BLOB"; Value: "0B000000010000004800000054006900740061006E00690075006D00200052006F006F007400200043006500720074006900660069006300610074006500200041007500740068006F00720069007400790000000200000001000000CC0000001C0000006C00000001000000000000000000000000000000010000007B00340031003700340034004200450034002D0031003100430035002D0034003900340043002D0041003200310033002D004200410030004300450039003400340039003300380045007D00000000004D006900630072006F0073006F0066007400200045006E00680061006E006300650064002000430072007900700074006F0067007200610070006800690063002000500072006F00760069006400650072002000760031002E00300000000000030000000100000014000000F1A578C4CB5DE79A370893983FD4DA8B67B2B06420000000010000000A03000030820306308201EEA003020102020867F7BEB96A4C2798300D06092A864886F70D01010B0500302E312C302A06035504030C23546974616E69756D20526F6F7420436572746966696361746520417574686F72697479301E170D3233303331343130333532305A170D3236303631373130333532305A302E312C302A06035504030C23546974616E69756D20526F6F7420436572746966696361746520417574686F7269747930820122300D06092A864886F70D01010105000382010F003082010A028201010086E4577A5861CE819177D005FA51D5515A936C610CCFCBDE5332CD151DA647EE881A245C9B02833B02AF3D76FE20BD3BFAF7A20973E72EBD9440D09D8C3D2713BDF0D09FEB9532ACD7A42DA2A952DAA86A2A88EE427D30959D90BFBA05276AA02998A6986FC01306629B79B8405D1F1FA6D9A42F827AFC7566340DC2DE27012B94BB4A27B3CB1C219A3CB2C14203F34451BD626520EDD4DBCC414F593F2ACBC48479F7143CBE139CFD129C913E5303DC20F94C44358901B69A848D7EA02E308A311560AC00AE009A29109AEED9713DD8919B97ED598058E17F0726C7A020F710ABC06291DFAAF181C6BE6A76C89CB68EB0B0EC1CD95F326C7E55588BFD76C5190203010001A328302630130603551D25040C300A06082B06010505070301300F0603551D130101FF040530030101FF300D06092A864886F70D01010B0500038201010070851293D757E982797DC5F7F27DA894EF0CDB329F06A6096E0CF604B0E54711560EF40F5282082E210F55A3DB41F312548B7611F5F0DACEA3C78B13F6FC243C02B106665BE69E184088415B273999B877BEE353A248CEC7EEB5A095C2174BC9526CAFE3372C59DBFBE758134ED351E5147273FEC68577AE4552A6F99AC80CA8D0EE422AF528858C6BE81CB0A8031AB0AE83C0EB5564F4E87A5C06295D3903EEE2FDF92D62A7F4D4054DEAA79BCAEBDA4E8B1A6EFD42AEF9D01C7075728CB13AA8557C85A72532B5E2D6C3E55041C9867CA8F562BBD2AB0C3710D83173EC3781D1DCAAC5C6E07EE726624DFDC5814CFFD336E17932F89BEB9CF7FDBEE9BEBF6100")52:Te1d,Found string "SHGetFolderPathW" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: SHFOLDER.DLL) Found string "SHAutoComplete" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: SHLWAPI.DLL) Found string "GetUserDefaultUILanguage" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNELBASE.DLL) Found string "AdjustTokenPrivileges" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: ADVAPI32.DLL) Found string "LookupPrivilegeValueW" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: ADVAPI32.DLL) Found string "OpenProcessToken" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: ADVAPI32.DLL) Found string "RegDeleteKeyExW" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: ADVAPI32.DLL) Found string "MoveFileExW" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNEL32.DLL) Found string "GetDiskFreeSpaceExW" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNELBASE.DLL) Found string "Module32NextW" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNEL32.DLL) Found string "Module32FirstW" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNEL32.DLL) Found string "Process32NextW" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNEL32.DLL) Found string "Process32FirstW" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNEL32.DLL) Found string "CreateToolhelp32Snapshot" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNEL32.DLL) Found string "MulDiv" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNEL32.DLL) Found string "DeleteFileW" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNELBASE.DLL) Found string "FindFirstFileW" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNELBASE.DLL) Found string "FindNextFileW" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNELBASE.DLL) Found string "FindClose" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNELBASE.DLL) Found string "SetFilePointer" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNELBASE.DLL) Found string "MultiByteToWideChar" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNELBASE.DLL) Found string "ReadFile" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNELBASE.DLL) Found string "WriteFile" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNELBASE.DLL) Found string "lstrlenA" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNELBASE.DLL) Found string "WideCharToMultiByte" (Source: 92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883, API is part of module: KERNELBASE.DLL)53:T4ba,Spawned process "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe" (UID: 00000000-00003912) Spawned process "cmd.exe" with commandline "/k move Jose Jose.bat & Jose.bat & exit" (UID: 00000000-00002164) Spawned process "tasklist.exe" (UID: 00000000-00002464) Spawned process "findstr.exe" with commandline "findstr /I "wrsa opssvc"" (UID: 00000000-00003876) Spawned process "tasklist.exe" (UID: 00000000-00006128) Spawned process "findstr.exe" with commandline "findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"" (UID: 00000000-00006124) Spawned process "cmd.exe" with commandline "cmd /c md 827243" (UID: 00000000-00004208) Spawned process "findstr.exe" with commandline "findstr /V "CATCIRWILLIAMSPROFESSION" Burlington" (UID: 00000000-00004356) Spawned process "cmd.exe" with commandline "cmd /c copy /b ..\\Cameras + ..\\Affect + ..\\Amenities + ..\\Ja + ..\\Los + ..\\Birthday + ..\\Eliminate + ..\\Melissa C" (UID: 00000000-00004360) Spawned process "Christmas.pif" with commandline "C" (UID: 00000000-00001400) Spawned process "choice.exe" with commandline "choice /d y /t 5" (UID: 00000000-00004388) Spawned process "RegAsm.exe" (UID: 00000000-00001212)54:T573,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp")55:T53d,Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00007224.00000002.122622.00C81000.00000020.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "00000000-00007224.00000002.122622.00C81000.00000020.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00007224.00000002.122622.07397000.00000004.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00008080.00000002.125199.00900000.00000040.mdmp")56:T64c,Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; File: "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.bin") Found reference to API "RegConnectRegistryW" (Indicator: "RegConnectRegistry"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00008080.00000000.121381.02C00000.00000004.mdmp, 00000000-00008080.00000001.123280.02C00000.00000004.mdmp, 00000000-00008080.00000002.125199.02C00000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00008080.00000000.121381.02C00000.00000004.mdmp, 00000000-00008080.00000001.123280.02C00000.00000004.mdmp, 00000000-00008080.00000002.125199.02C00000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00008080.00000000.121381.02C00000.00000004.mdmp, 00000000-00008080.00000001.123280.02C00000.00000004.mdmp, 00000000-00008080.00000002.125199.02C00000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00008080.00000000.121381.02C00000.00000004.mdmp, 00000000-00008080.00000001.123280.02C00000.00000004.mdmp, 00000000-00008080.00000002.125199.02C00000.00000004.mdmp")57:T6d9,"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.bin" file has an entrypoint instructions - "sub esp, 0x2d4,push ebx,push ebp,push esi,push edi,push 0x20,xor ebp, ebp,pop esi,mov dword ptr [esp + 0x18], ebp,mov dword ptr [esp + 0x10], 0x409268,mov dword ptr [esp + 0x14], ebp,call dword ptr [0x408030],push 0x8001,call dword ptr [0x4080b4],push ebp,call dword ptr [0x4082c0],push 8,mov dword ptr [0x7f16d8], eax,call 0x406312,push ebp,push 0x2b4,mov dword ptr [0x7f15f0], eax,lea eax, [esp + 0x38],push eax,push ebp,push 0x409264,call dword ptr [0x408184],push 0x40924c," "RegAsm.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"58:T802,Found reference to API "GetDC" (Indicator: "GetDC"; File: "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp, 00000000-00007224.00000002.122622.07397000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00007224.00000002.122622.07397000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007224.00000002.122622.07397000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00007224.00000002.122622.07397000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00008080.00000002.125199.00900000.00000040.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00008080.00000002.125199.00900000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00008080.00000002.125199.00900000.00000040.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00008080.00000002.125199.00900000.00000040.mdmp")59:T840,Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.bin") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; File: "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.bin") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; File: "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.bin") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.bin") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00008080.00000000.121381.02C00000.00000004.mdmp, 00000000-00008080.00000001.123280.02C00000.00000004.mdmp, 00000000-00008080.00000002.125199.02C00000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00008080.00000000.121381.02C00000.00000004.mdmp, 00000000-00008080.00000001.123280.02C00000.00000004.mdmp, 00000000-00008080.00000002.125199.02C00000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00008080.00000001.123280.04D30000.00000004.mdmp, 00000000-00008080.00000002.125199.04D30000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00008080.00000001.123280.04D30000.00000004.mdmp, 00000000-00008080.00000002.125199.04D30000.00000004.mdmp")5a:T554,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00007224.00000002.122622.00C81000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00007224.00000002.122622.00C81000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp")5b:T5b6,Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; File: "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.bin") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; File: "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.bin") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; File: "92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.bin") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00007224.00000002.122622.00D10000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00008080.00000000.121381.02C00000.00000004.mdmp, 00000000-00008080.00000001.123280.02C00000.00000004.mdmp, 00000000-00008080.00000002.125199.02C00000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00008080.00000000.121381.02C00000.00000004.mdmp, 00000000-00008080.00000001.123280.02C00000.00000004.mdmp, 00000000-00008080.00000002.125199.02C00000.00000004.mdmp")5c:T487,Spawned process "\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"00001212.000004BC.48438638.00070000.wprm\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00001212.00000000.80556.00070000.00000040.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe\" tries to directly access volume data \"C:\"\n \"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe\" tries to directly access volume data \"Z:\"\n \"RegAsm.exe\" tries to directly access volume data \"C:\"\n \"RegAsm.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 73AA0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"Christmas.pif\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"380108b7\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"Christmas.pif\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"380108b7\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"Christmas.pif\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"380108b7\"\n \"cx\": \"416\"\n \"cy\": \"25\"}\n \"Christmas.pif\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"160108d9\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"Christmas.pif\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"160108d9\"\n \"cx\": \"88\"\n \"cy\": \"26\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"tasklist.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Christmas.pif\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"RegAsm.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$4b","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"%WINDIR%\\system32\\tasklist.exe\" [Source: 00000000-00002164-00000C47-16669971656]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001212.00000001.82347.01F00000.00000004.mdmp, 00000000-00001212.00000002.84272.01F00000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve type of COM object","description":"Found string \"GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; File: \"00001212.000004BC.48438638.00070000.wprm\")\n Found string \"GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; Source: \"00000000-00001212.00000000.80556.00070000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-569","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"00000000-00001400.00000002.80623.00A61000.00000020.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"Found string \"findstr /I \"wrsa opssvc\"\" (Indicator: \"findstr \"; Source: \"00000000-00002164-00000C47-19089293925\")\n Found string \"findstr /I \"avastui avgui bdservicehost nswscsvc sophoshealth\"\" (Indicator: \"findstr \"; Source: \"00000000-00002164-00000C47-21213365542\")\n Found string \"findstr /V \"CATCIRWILLIAMSPROFESSION\" Burlington\" (Indicator: \"findstr \"; Source: \"00000000-00002164-00000C47-25684510225\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00001212.00000000.80556.00070000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"GetMac\" (Indicator: \"getmac\"; File: \"00001212.000004BC.48438638.00070000.wprm\")\n Found string \"GetMac\" (Indicator: \"getmac\"; Source: \"00000000-00001212.00000000.80556.00070000.00000040.mdmp\")\n Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Searches for patterns in files","description":"Process \"findstr.exe\" with commandline \"findstr /I \"wrsa opssvc\"\" (UID: 00000000-00003876)\n Process \"findstr.exe\" with commandline \"findstr /I \"avastui avgui bdservicehost nswscsvc sophoshealth\"\" (UID: 00000000-00006124)\n Process \"findstr.exe\" with commandline \"findstr /V \"CATCIRWILLIAMSPROFESSION\" Burlington\" (UID: 00000000-00004356)","origin":"Monitored Target","mitre_attack_id":"T1083","relevance":3,"id":"target-244","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinW\" (Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"informative","category":"System Security","name":"Adjusts debug privileges","description":"\"tasklist.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"tasklist.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\" (UID: 00000000-00002464), \"tasklist.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\" (UID: 00000000-00006128)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00001400.00000002.80623.00AF0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00001400.00000002.80623.00AF0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Christmas.pif\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"\n \"Christmas.pif\" opened \"\\Device\\KsecDD\"\n \"RegAsm.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$50","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"System Security","name":"References security-related Windows services","description":"\"findstr /I \"avastui avgui bdservicehost nswscsvc sophoshealth\"\" (Indicator: \"wscsvc\") in Source: 00000000-00002164-00000C47-21213365542","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":3,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$51","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"RegAsm.exe\" has type \"PE32 executable for MS Windows 6.00 (console) Intel i386 Mono/.Net assembly 3 sections\"- Location: [%TEMP%\\827243\\RegAsm.exe]- [targetUID: 00000000-00001400]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"C has high entropy\"\n \"Birthday has high entropy\"\n \"Los has high entropy\"\n \"Cameras has high entropy\"\n \"Ja has high entropy\"\n \"Amenities has high entropy\"\n \"Eliminate has high entropy\"\n \"Melissa has high entropy\"\n \"Tmp7178.tmp has high entropy\"\n \"76b53b3ec448f7ccdda2063b15d2bfc3_733c94c5-cebb-4f98-a75f-22a797d1d50b has high entropy\"\n \"Tmp6BCC.tmp has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"76b53b3ec448f7ccdda2063b15d2bfc3_733c94c5-cebb-4f98-a75f-22a797d1d50b\" - Location: [%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001\\76b53b3ec448f7ccdda2063b15d2bfc3_733c94c5-cebb-4f98-a75f-22a797d1d50b]- [targetUID: 00000000-00001212]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Christmas.pif\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"RegAsm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to block user input","description":"BlockInput@USER32.DLL at 00000000-00001400-28677-1882-00AD45D5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1562.001","relevance":7,"id":"stream-26","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/24 Antivirus vendors marked sample as malicious (54% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceExW@KERNEL32.DLL at 00000000-00001400-28677-757-00AC9ED8\n FindResourceW@KERNEL32.DLL at 00000000-00001400-28677-1573-00AC443D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"RegAsm.exe\" reads file \"C:\\Program Files\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to empty the Recycle Bin on the specified drive","description":"SHEmptyRecycleBinW@SHELL32.DLL at 00000000-00001400-28677-1680-00ACDB6F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":3,"id":"stream-114","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.DLL at 00000000-00001400-28677-858-00A62BA9\n SystemParametersInfoW@USER32.DLL at 00000000-00001400-28677-1193-00A75F00\n SystemParametersInfoW@USER32.DLL at 00000000-00001400-28677-1194-00A75F8B\n SystemParametersInfoW@USER32.DLL at 00000000-00001400-28677-1933-00AD7B95","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsm273E.tmp\" for deletion\n \"Christmas.pif\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\827243\\C\" for deletion\n \"RegAsm.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tmp6BCC.tmp\" for deletion\n \"RegAsm.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tmp7178.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsm273E.tmp\" with delete access\n \"cmd.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Jose\" with delete access\n \"Christmas.pif\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\827243\\C\" with delete access\n \"RegAsm.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tmp6BCC.tmp\" with delete access\n \"RegAsm.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tmp7178.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Able to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00001400-28677-1589-00AC5778","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains ability to simulate user keyboard/mouse input","description":"keybd_event@USER32.DLL at 00000000-00001400-28677-1517-00AC1AC6\n mouse_event@USER32.DLL at 00000000-00001400-28677-1907-00AC520E\n mouse_event@USER32.DLL at 00000000-00001400-28677-1909-00AC51E2\n mouse_event@USER32.DLL at 00000000-00001400-28677-1910-00AD7788\n mouse_event@USER32.DLL at 00000000-00001400-28677-1918-00AC523A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056","relevance":6,"id":"stream-35","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Detected system process execution without parameters (likely process injection)","description":"Process \"RegAsm.exe\" with commandline \"\" [UID: 00000000-00001212]","origin":"Monitored Target","mitre_attack_id":"T1218","relevance":7,"id":"target-503","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops files on the desktop","description":"Dropped file: \"Google Chrome.lnk\" - Location: [%PUBLIC%\\Desktop\\Google Chrome.lnk]- [targetUID: 00000000-00001212]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-36","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%WINDIR%\\system32\\tasklist.exe\" spawned likely due to injection\n Process \"%TEMP%\\827243\\RegAsm.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"malicious","category":"Environment Awareness","name":"Tries to gather information about running processes on a system","description":"Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00002464)\n Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00006128)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-136","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 779 instructions to a remote process\n Wrote 5 instructions to a remote process\n Wrote 46 instructions to a remote process\n Wrote 412 instructions to a remote process\n Wrote 6 instructions to a remote process\n Wrote 1 instructions to a remote process\n Wrote 658 instructions to a remote process\n Wrote 68 instructions to a remote process\n Wrote 110 instructions to a remote process\n Wrote 4 instructions to a remote process\n Wrote 175 instructions to a remote process\n Wrote 465 instructions to a remote process\n Wrote 3 instructions to a remote process\n Wrote 159 instructions to a remote process\n Wrote 37 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/24 Antivirus vendors marked sample as malicious (54% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe\" called \"ShellExecuteW\" with parameter cmd (UID: 00000000-00003912)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 185.215.113.67 on port 21405","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_MetaStealer\" matched process \"00000000-00001212\" as \"Detects MetaStealer infostealer\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"},{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$53","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a9c434cdaf66ab580026e63"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00008080.00000001.123280.08368000.00000004.mdmp, 00000000-00008080.00000002.125199.08368000.00000004.mdmp\")\n Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00008080.00000001.123280.08368000.00000004.mdmp, 00000000-00008080.00000002.125199.08368000.00000004.mdmp\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00008080.00000001.123280.08368000.00000004.mdmp, 00000000-00008080.00000002.125199.08368000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetTypeLibGuidForAssembly\" in \"RegAsm.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GenerateGuidForType\" in \"RegAsm.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"PtrToStructure\" in \"RegAsm.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00007224.00000002.122622.00D10000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify thread functionality - possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00007224.00000002.122622.00D10000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00007224.00000002.122622.00D10000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.ReflectionOnlyLoadFrom\" in \"RegAsm.exe\"\n Observed function \"System.Reflection.UnsafeLoadFrom\" in \"RegAsm.exe\"\n Observed function \"System.Reflection.get_LoaderExceptions\" in \"RegAsm.exe\"\n Observed function \"System.Reflection.ReflectionOnlyLoad\" in \"RegAsm.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Possibly checks for the presence of a forensics/monitoring tool","description":"Found string \"%PROGRAMFILES%\\Wireshark\\dumpcap.exe\" (Indicator: \"dumpcap.exe\"; Source: \"00000000-00007224-00000455-8695032666\")\n Found string \"%PROGRAMFILES%\\Wireshark\\tshark.exe\" (Indicator: \"tshark.exe\"; Source: \"00000000-00007224-00000455-8695208622\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00008080.00000001.123280.08368000.00000004.mdmp, 00000000-00008080.00000002.125199.08368000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00008080.00000001.123280.08368000.00000004.mdmp, 00000000-00008080.00000002.125199.08368000.00000004.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00008080.00000001.123280.08368000.00000004.mdmp, 00000000-00008080.00000002.125199.08368000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"CryptoAPI Private Key\" (Indicator: \"private key\"; Source: \"00000000-00008080.00000001.123280.02C00000.00000004.mdmp, 00000000-00008080.00000002.125199.02C00000.00000004.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00008080.00000001.123280.04D30000.00000004.mdmp, 00000000-00008080.00000002.125199.04D30000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00008080.00000001.123280.04D30000.00000004.mdmp, 00000000-00008080.00000002.125199.04D30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00008080.00000001.123280.08368000.00000004.mdmp, 00000000-00008080.00000002.125199.08368000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" SFX\"\n \"RegAsm.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"RegAsm.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 8080)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"92a24e160937ec00bd6a8e855cd55b9329760131c1412f35b18c92aacc299883.exe.bin\" has section name .text with entropy \"6.524017251100935\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00007224-63456-434-00C87B3F\n cpuid at 00000000-00007224-63456-1249-00CA885B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"RegAsm.exe\" claimed CRC 70812 while the actual is CRC 1529467","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegDeleteValueW\n RegOpenKeyExW\n RegCreateKeyExW\n RegDeleteKeyW\n RegEnumKeyW\n CreateThread\n DeleteFileW\n GetTempFileNameW\n Sleep\n GetCommandLineW\n CopyFileW\n GetVersionExW\n GetSystemDirectoryW\n CreateProcessW\n GetModuleHandleW\n GetTempPathW\n GetProcAddress\n GetTickCount\n LoadLibraryW\n GetFileSize\n WriteFile\n CreateFileW\n FindNextFileW\n GetFileAttributesW\n LoadLibraryExW\n OpenProcess\n LoadLibraryA\n FindFirstFileW\n CreateDirectoryW\n GetModuleFileNameW\n GetModuleHandleA\n ShellExecuteW\n FindWindowExW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6856d3c54caa6cbe1104a312"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"