26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.MSIL.Quasar Sample 9bc86d760088… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9bc86d760088…. Malware family: Trojan.MSIL.Quasar. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77","keywords":["Malicious","Trojan.MSIL.Quasar","malware analysis","sandbox report","threat intelligence","9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77"],"about":{"@type":"SoftwareApplication","name":"007062299.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.MSIL.Quasar","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Te1f,Found reference to "PbeSha1_RC2_40" (Indicator: "RC2"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "RC2_CBC_40" (Indicator: "RC2"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "SRTP_NULL_HMAC_SHA1_80" (Indicator: "HMAC"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "HMAC"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "HMAC_SHA1" (Indicator: "HMAC"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "EncryptionECDsaWithSha1" (Indicator: "ECDsa"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "TRAILER_SHA512" (Indicator: "SHA512"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "ecka_eg_X963kdf_SHA512" (Indicator: "SHA512"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "sphincs256_with_SHA512" (Indicator: "SHA512"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "xmss_with_SHA512" (Indicator: "SHA512"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "xmss_mt_with_SHA512" (Indicator: "SHA512"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "ecdsa_plain_SHA512" (Indicator: "SHA512"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "EncryptionECDsaWithSha512" (Indicator: "ECDsa"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "SRTP_NULL_HMAC_SHA1_32" (Indicator: "HMAC"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "HMAC"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "Aes192" (Indicator: "Aes"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "ECDsaWithSha2" (Indicator: "ECDsa"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "TRAILER_SHA512_224" (Indicator: "SHA512"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "EncryptionECDsaWithSha224" (Indicator: "ECDsa"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "RC2_64" (Indicator: "RC2"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found reference to "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin")28:T4155,Contains long base64 encoded string "Fgke5eQmm1qHDFmgKHezxsUVV8MiWd8Ge6q/edMwtF+VLrQMb+pEHI8UZ2ZuhPmS5UE5XLB3RhoIQLEqU43o4ZWg86JI2mVoHQb1lP6XEq6dGLGGkNNnSjn4ehil5Ih+/Wb0KSGShwwhiY4J+cMLRp6aKef/MhYay5ZGv5ayWNvfqUbG9a89MdDTW/1o2jrPXUnfvwaR4KF5KsMorAqjeLV7eEUOL/+rNL0dW6Ny8NDdMWQ1DFSmZ8C/XlntLWflmjdZYHPdMkifSmBx1zQ+IpnpsZRUMxh5GrJQxTLLe4oDxRWKPPBbF+jHji5d0oV2LhFMEUbWvhfo07kYpPbaMv4wJfW0p6wKL3qTkHkQAhVyVlrBF47la/SW5bgQAqtoDUHB9oY3sMuoKYnmhSqnaDL+xAty392qWo4tEY2yJokgafrcggl08oVXWEvgoCCfMmHPJBCvp6hsFBRjvouTpvJEbuNzUyyCxGfTYTNq0f2bmUuZV1SgwU88u2HUlfOH/EpFFHgnDVwdJoRnCYh/APZkIKSiZYsaTAA3DnSW1BdeIu5Lo2FF9F3HGPbyMkCaz0seel0L4YqleuSaqUc6X11CyN83D9cvPqV8YUyYEWCUb0P1WMOD3JW7s8/nWah5yDAL5WNqYFO/1GFg0+53ueCvyUaTEON6KlVksA39um7n8wrK9c5YLlqfdVQMcagaLRxktKbGiTRO2FpzmqyuYe2Bu8o1lmy1r775QNix/O4DRjXecpW3QE8h1Ctjfhl530GHJ8FDzXMWjuo+3XZY1DyM2tuGtfWaosANp0mYf7fHy5vSPCv3NrvU9T3ccEimloQ+GL6eBUp2V4us3XP8ai74snoXdqFFe70PTPL6jc2Ej6PtvVra2sHJP5EZvRALP7SI86HWFzOcoW/4CoSQtt6ykAKSlYxMRN8K+IKjU36tow0/TkvlBSBMfFrNRnzbsZKK/DD0c+KMH5+/5ZdCBg==" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA237327FFFFFFFFFFFFFFFF" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A92108011A723C12A787E6D788719A10BDBA5B2699C327186AF4E23C1A946834B6150BDA2583E9CA2AD44CE8DBBBC2DB04DE8EF92E8EFC141FBECAA6287C59474E6BC05D99B2964FA090C3A2233BA186515BE7ED1F612970CEE2D7AFB81BDD762170481CD0069127D5B05AA993B4EA988D8FDDC186FFB7DC90A6C08F4DF435C93402849236C3FAB4D27C7026" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "C1D4DCB2602646DEC9751E763DBA37BDF8FF9406AD9E530EE5DB382F413001AEB06A53ED9027D831179727B0865A8918DA3EDBEBCF9B14ED44CE6CBACED4BB1BDB7F1447E6CC254B332051512BD7AF426FB8F401378CD2BF5983CA01C64B92ECF032EA15D1721D03F482D7CE6E74FEF6D55E702F46980C82B5A84031900B1C9E59E7C97FBEC7E8F323A97A7E36CC88BE0F1D45B7FF585AC54BD407B22B4154AACC8F6D7EBF48E1D814CC5ED20F8037E0A79715EEF29BE32806A1D58BB7C5DA76F550AA3D8A1FBFF0EB19CCB1A313D55CDA56C9EC2EF29632387FE8D76E3C0468043E8F663F4860EE12BF2D5B0B7474D6E694F91E6DCC4024FFFFFFFFFFFFFFFF" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "FFFFFFFFFFFFFFFFADF85458A2BB4A9AAFDC5620273D3CF1D8B9C583CE2D3695A9E13641146433FBCC939DCE249B3EF97D2FE363630C75D8F681B202AEC4617AD3DF1ED5D5FD65612433F51F5F066ED0856365553DED1AF3B557135E7F57C935984F0C70E0E68B77E2A689DAF3EFE8721DF158A136ADE73530ACCA4F483A797ABC0AB182B324FB61D108A94BB2C8E3FBB96ADAB760D7F4681D4F42A3DE394DF4AE56EDE76372BB190B07A7C8EE0A6D709E02FCE1CDF7E2ECC03404CD28342F619172FE9CE98583FF8E4F1232EEF28183C3FE3B1B4C6FAD733BB5FCBC2EC22005C58EF1837D1683B2C6F34A26C1B2EFFA886B423861285C97FFFFFFFFFFFFFFFF" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "FFFFFFFFFFFFFFFFADF85458A2BB4A9AAFDC5620273D3CF1D8B9C583CE2D3695A9E13641146433FBCC939DCE249B3EF97D2FE363630C75D8F681B202AEC4617AD3DF1ED5D5FD65612433F51F5F066ED0856365553DED1AF3B557135E7F57C935984F0C70E0E68B77E2A689DAF3EFE8721DF158A136ADE73530ACCA4F483A797ABC0AB182B324FB61D108A94BB2C8E3FBB96ADAB760D7F4681D4F42A3DE394DF4AE56EDE76372BB190B07A7C8EE0A6D709E02FCE1CDF7E2ECC03404CD28342F619172FE9CE98583FF8E4F1232EEF28183C3FE3B1B4C6FAD733BB5FCBC2EC22005C58EF1837D1683B2C6F34A26C1B2EFFA886B4238611FCFDCDE355B3B6519035BBC34F4DEF99C023861B46FC9D6E6C9077AD91D2691F7F7EE598CB0FAC186D91CAEFE130985139270B4130C93BC437944F4FD4452E2D74DD364F2E21E71F54BFF5CAE82AB9C9DF69EE86D2BC522363A0DABC521979B0DEADA1DBF9A42D5C4484E0ABCD06BFA53DDEF3C1B20EE3FD59D7C25E41D2B669E1EF16E6F52C3164DF4FB7930E9E4E58857B6AC7D5F42D69F6D187763CF1D5503400487F55BA57E31CC7A7135C886EFB4318AED6A1E012D9E6832A907600A918130C46DC778F971AD0038092999A333CB8B7A1A1DB93D7140003C2A4ECEA9F98D0ACC0A8291CDCEC97DCF8EC9B55A7F88A46B4DB5A851F44182E1C68A007E5E655F6AFFFFFFFFFFFFFFFF" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "FFFFFFFFFFFFFFFFADF85458A2BB4A9AAFDC5620273D3CF1D8B9C583CE2D3695A9E13641146433FBCC939DCE249B3EF97D2FE363630C75D8F681B202AEC4617AD3DF1ED5D5FD65612433F51F5F066ED0856365553DED1AF3B557135E7F57C935984F0C70E0E68B77E2A689DAF3EFE8721DF158A136ADE73530ACCA4F483A797ABC0AB182B324FB61D108A94BB2C8E3FBB96ADAB760D7F4681D4F42A3DE394DF4AE56EDE76372BB190B07A7C8EE0A6D709E02FCE1CDF7E2ECC03404CD28342F619172FE9CE98583FF8E4F1232EEF28183C3FE3B1B4C6FAD733BB5FCBC2EC22005C58EF1837D1683B2C6F34A26C1B2EFFA886B4238611FCFDCDE355B3B6519035BBC34F4DEF99C023861B46FC9D6E6C9077AD91D2691F7F7EE598CB0FAC186D91CAEFE130985139270B4130C93BC437944F4FD4452E2D74DD364F2E21E71F54BFF5CAE82AB9C9DF69EE86D2BC522363A0DABC521979B0DEADA1DBF9A42D5C4484E0ABCD06BFA53DDEF3C1B20EE3FD59D7C25E41D2B669E1EF16E6F52C3164DF4FB7930E9E4E58857B6AC7D5F42D69F6D187763CF1D5503400487F55BA57E31CC7A7135C886EFB4318AED6A1E012D9E6832A907600A918130C46DC778F971AD0038092999A333CB8B7A1A1DB93D7140003C2A4ECEA9F98D0ACC0A8291CDCEC97DCF8EC9B55A7F88A46B4DB5A851F44182E1C68A007E5E0DD9020BFD64B645036C7A" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "4E677D2C38532A3A23BA4442CAF53EA63BB454329B7624C8917BDD64B1C0FD4CB38E8C334C701C3ACDAD0657FCCFEC719B1F5C3E4E46041F388147FB4CFDB477A52471F7A9A96910B855322EDB6340D8A00EF092350511E30ABEC1FFF9E3A26E7FB29F8C183023C3587E38DA0077D9B4763E4E4B94B2BBC194C6651E77CAF992EEAAC0232A281BF6B3A739C1226116820AE8DB5847A67CBEF9C9091B462D538CD72B03746AE77F5E62292C311562A846505DC82DB854338AE49F5235C95B91178CCF2DD5CACEF403EC9D1810C6272B045B3B71F9DC6B80D63FDD4A8E9ADB1E6962A69526D43161C1A41D570D7938DAD4A40E329CCFF46AAA36AD004CF600C8381E425A31D951AE64FDB23FCEC9509D43687FEB69EDD1CC5E0B8CC3BDF64B10EF86B63142A3AB8829555B2F747C932665CB2C0F1CC01BD70229388839D2AF05E454504AC78B7582822846C0BA35C35F5C59160CC046FD8251541FC68C9C86B022BB7099876A460E7451A8A93109703FEE1C217E6C3826E52C51AA691E0E423CFC99E9E31650C1217B624816CDAD9A95F9D5B8019488D9C0A0A1FE3075A577E23183F81D4A3F2FA4571EFC8CE0BA8A4FE8B6855DFE72B0A66EDED2FBABFBE58A30FAFABE1C5D71A87E2F741EF8C1FE86FEA6BBFDE530677F0D97D11D49F7A8443D0822E506A9F4614E011E2A94838FF88CD68C8BB7C5C6424CFFFFFFFFFFFFFFFF" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "9DEF3CAFB939277AB1F12A8617A47BBBDBA51DF499AC4C80BEEEA9614B19CC4D5F4F5F556E27CBDE51C6A94BE4607A291558903BA0D0F84380B655BB9A22E8DCDF028A7CEC67F0D08134B1C8B97989149B609E0BE3BAB63D47548381DBC5B1FC764E3F4B53DD9DA1158BFD3E2B9C8CF56EDF019539349627DB2FD53D24B7C48665772E437D6C7F8CE442734AF7CCB7AE837C264AE3A9BEB87F8A2FE9B8B5292E5A021FFF5E91479E8CE7A28C2442C6F315180F93499A234DCF76E3FED135F9BB" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "fd7f53811d75122952df4a9c2eece4e7f611b7523cef4400c31e3f80b6512669455d402251fb593d8d58fabfc5f5ba30f6cb9b556cd7813b801d346ff26660b76b9950a5a49f9fe8047b1022c24fbba9d7feb7c61bf83b57e7c6a8a6150f04fb83f6d3c51ec3023554135a169132f675f3ae2b61d72aeff22203199dd14801c7" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "C196BA05AC29E1F9C3C72D56DFFC6154A033F1477AC88EC37F09BE6C5BB95F51C296DD20D1A28A067CCC4D4316A4BD1DCA55ED1066D438C35AEBAABF57E7DAE428782A95ECA1C143DB701FD48533A3C18F0FE23557EA7AE619ECACC7E0B51652A8776D02A425567DED36EABD90CA33A1E8D988F0BBB92D02D1D20290113BB562CE1FC856EEB7CDD92D33EEA6F410859B179E7E789A8F75F645FAE2E136D252BFFAFF89528945C1ABE705A38DBC2D364AADE99BE0D0AAD82E5320121496DC65B3930E38047294FF877831A16D5228418DE8AB275D7D75651CEFED65F78AFC3EA7FE4D79B35F62A0402A1117599ADAC7B269A59F353CF450E6982D3B1702D9CA83" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "90066455B5CFC38F9CAA4A48B4281F292C260FEEF01FD61037E56258A7795A1C7AD46076982CE6BB956936C6AB4DCFE05E6784586940CA544B9B2140E1EB523F009D20A7E7880E4E5BFA690F1B9004A27811CD9904AF70420EEFD6EA11EF7DA129F58835FF56B89FAA637BC9AC2EFAAB903402229F491D8D3485261CD068699B6BA58A1DDBBEF6DB51E8FE34E8A78E542D7BA351C21EA8D8F1D29F5D5D15939487E27F4416B0CA632C59EFD1B1EB66511A5A0FBF615B766C5862D0BD8A3FE7A0E0DA0FB2FE1FCB19E8F9996A8EA0FCCDE538175238FC8B0EE6F29AF7F642773EBE8CD5402415A01451A840476B2FCEB0E388D30D4B376C37FE401C2A2C2F941DAD179C540C1C8CE030D460C4D983BE9AB0B20F69144C1AE13F9383EA1C08504FB0BF321503EFE43488310DD8DC77EC5B8349B8BFE97C2C560EA878DE87C11E3D597F1FEA742D73EEC7F37BE43949EF1A0D15C3F3E3FC0A8335617055AC91328EC22B50FC15B941D3D1624CD88BC25F3E941FDDC6200689581BFEC416B4B2CB73" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "5E5CBA992E0A680D885EB903AEA78E4A45A469103D448EDE3B7ACCC54D521E37F84A4BDD5B06B0970CC2D2BBB715F7B82846F9A0C393914C792E6A923E2117AB805276A975AADB5261D91673EA9AAFFEECBFA6183DFCB5D3B7332AA19275AFA1F8EC0B60FB6F66CC23AE4870791D5982AAD1AA9485FD8F4A60126FEB2CF05DB8A7F0F09B3397F3937F2E90B9E5B9C9B6EFEF642BC48351C46FB171B9BFA9EF17A961CE96C7E7A7CC3D3D03DFAD1078BA21DA425198F07D2481622BCE45969D9C4D6063D72AB7A0F08B2F49A7CC6AF335E08C4720E31476B67299E231F8BD90B39AC3AE3BE0C6B6CACEF8289A2E2873D58E51E029CAFBD55E6841489AB66B5B4B9BA6E2F784660896AFF387D92844CCB8B69475496DE19DA2E58259B090489AC8E62363CDF82CFD8EF2A427ABCD65750B506F56DDE3B988567A88126B914D7828E2B63A6D7ED0747EC59E0E0A23CE7D8A74C1D2C2A7AFB6A29799620F00E11C33787F7DED3B30E1A22D09F1FBDA1ABBBFBF25CAE05A13F812E34563F99410E73B" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "42941826148615804143873447737955502392672345968607143066798112994089471231420027060385216699563848719957657284814898909770759462613437669456364882730370838934791080835932647976778601915343474400961034231316672578686920482194932878633360203384797092684342247621055760235016132614780652761028509445403338652341" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "002400000480000094000000060200000024000052534131000400000100010083a6a1d0d41b8a0fd3061c8dd2ba14da98f9bf53576ad386a4d021abd235ee41bc5416683314816908765fac4951301e159153cf02bf1b31bec8a2ce6c0110c30cc7bef54e514d530b703d37629078ab3ecce1afa5ed3f9d63f3b50398188a811ada59827b9e1a4eeeb87d05e4afe45befd69bf2cdfd37f38334b748c8cb7fbc" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "AC6BDB41324A9A9BF166DE5E1389582FAF72B6651987EE07FC3192943DB56050A37329CBB4A099ED8193E0757767A13DD52312AB4B03310DCD7F48A9DA04FD50E8083969EDB767B0CF6095179A163AB3661A05FBD5FAAAE82918A9962F0B93B855F97993EC975EEAA80D740ADBF4FF747359D041D5C33EA71D281E446B14773BCA97B43A23FB801676BD207A436C6481F1D2B9078717461A5B9D32E688F87748544523B524B0D57D5EA77A2775D2ECFA032CFBDBF52FB3786160279004E57AE6AF874E7303CE53299CCC041C7BC308D82A5698F3A8D0C38271AE35F8E9DBFBB694B5C803D89F7AE435DE236D525F54759B65E372FCD68EF20FA7111F9E4AFF73" in [Source : 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin] Contains long base64 encoded string "Fgke5eQmm1qHDFmgKHezxsUVV8MiWd8Ge6q/edMwtF+VLrQMb+pEHI8UZ2ZuhPmS5UE5XLB3RhoIQLEqU43o4ZWg86JI2mVoHQb1lP6XEq6dGLGGkNNnSjn4ehil5Ih+/Wb0KSGShwwhiY4J+cMLRp6aKef/MhYay5ZGv5ayWNvfqUbG9a89MdDTW/1o2jrPXUnfvwaR4KF5KsMorAqjeLV7eEUOL/+rNL0dW6Ny8NDdMWQ1DFSmZ8C/XlntLWflmjdZYHPdMkifSmBx1zQ+IpnpsZRUMxh5GrJQxTLLe4oDxRWKPPBbF+jHji5d0oV2LhFMEUbWvhfo07kYpPbaMv4wJfW0p6wKL3qTkHkQAhVyVlrBF47la/SW5bgQAqtoDUHB9oY3sMuoKYnmhSqnaDL+xAty392qWo4tEY2yJokgafrcggl08oVXWEvgoCCfMmHPJBCvp6hsFBRjvouTpvJEbuNzUyyCxGfTYTNq0f2bmUuZV1SgwU88u2HUlfOH/EpFFHgnDVwdJoRnCYh/APZkIKSiZYsaTAA3DnSW1BdeIu5Lo2FF9F3HGPbyMkCaz0seel0L4YqleuSaqUc6X11CyN83D9cvPqV8YUyYEWCUb0P1WMOD3JW7s8/nWah5yDAL5WNqYFO/1GFg0+53ueCvyUaTEON6KlVksA39um7n8wrK9c5YLlqfdVQMcagaLRxktKbGiTRO2FpzmqyuYe2Bu8o1lmy1r775QNix/O4DRjXecpW3QE8h1Ctjfhl530GHJ8FDzXMWjuo+3XZY1DyM2tuGtfWaosANp0mYf7fHy5vSPCv3NrvU9T3ccEimloQ+GL6eBUp2V4us3XP8ai74snoXdqFFe70PTPL6jc2Ej6PtvVra2sHJP5EZvRALP7SI86HWFzOcoW/4CoSQtt6ykAKSlYxMRN8K+IKjU36tow0/TkvlBSBMfFrNRnzbsZKK/DD0c+KMH5+/5ZdCBg==" in [Source : 00000000-00000320.00000000.67901.01E50000.00000004.mdmp] Contains long base64 encoded string "TRUD6A2dw+lWXU5yAASPNPeDUPjqUu4ANcFi6hDbwLOT4t+9szd9FXLgMVPqyboCRy2OpKuLi559eMYoLar4wKx+Dd8fn2Od0jjYBT34q7rX+Z2WAyBMAc9fCfSrepWma0E+5qqJQbpTU01NB6s4YQL37Br8wLKA+s8Ke0NyCe4gKZD4ItIrbC0vDj/YnVbwjvncCMoELI3dlU35207adoNo950/ugoPJX2Ckerhgb3Y3UqxjbhMLHyS1s3Oqw24sHQPioIFLA6SzkDn1EhD0buscBHx3L29O2OjVvIeo44xk4Mo92oL7HakuLoFHWKcPaDXZd6RrQ00hlNNDxwFDPGTIvQwzpTjsxMN1SnFwLOYVN5tpVeyaFWjLjQLUkkqdfnoxTwkBwxF97QJO2wAPFfdzbiGy9OHnDIEj9ehG0+cAANqyiluugAPA/D04D6LBcu4VeTkJSfGSKFugC1Kmd4wth4LELe9zBqy+zNMKcRRR+qvcw5iq+wtkE/kqT2H05M0YsqppxOhQmvEDEvOHp5KHfuysrr4UBlwAaRcbtxaKFRhRlQCS2cyAITwl9EjmRaJPCsQbEu7CEElmlPmsBXUx9SWE/gGC+LrCmbkbAugkXQeMyl0z8oE6gMAaJkDOhTkuU1BL7VyofvduJWXrV41+Jvz9i+ioe9GBTgL/3wb1osrrstDtaKRwrv/3y4Yj/UnrwKVlICbI8kINolDycKgdUqOU/JJxIUMOd4dHzkpWedsj+XP6vESGvyV50XTD4X+l5H4cn4JsgEDTctIxEs7GsAdJju6RhSMT/xNNxo5HNXiwk8Lj6NsEEEiVKhMzPz1g56CLfe2fV+QTKcsd4E0aSMp2wvw+CAHqNuopZ4zl+wZ33Hy9myGMDzvKJL6piTLFjkxgQL4vRJuhAhvB9VOYmikUjuKkRmW3QmSTXJq8JCymU35TXpU52ZfBGR0UR2Cm8MZCgtzHSdgU4+xjGDpctl7qQqPNicrhX0RnROgxoYJJLd72kJWwjPO1CFg7mkWl3z7z/99TXNOwuj6zW3yVEKzB0KawfrsBnOahNDFergLYEFdxnJ6pndxpPMrRKffbRGEyq4scJDSQWbfIovDx9LZlaTGQmmWAdxNxMP9s7eumWfLk6eeb9OPxsBXjX4nxaxdbA5e7+W3EJ+oJ3R+xoohTGaATY7oqNUPEmHg7oPxZ2rO5CE248sBvHXCiTtOWlCTQ8wNVezxqcq1Uf50D62KhynDf8bYWGyVznuMswo1VC6aFYPmqk/U2rlr6hrZjI3Lmfg3PpxmoRRECQpbWlT8/RRXwQuBu5HntQW0HeF8z3MQFr/gYwEM2r1guaae6Zr39Ld2QzIqUWUwpoIHTOfF2OKYbF5s8ri2LBcGIITrqTts/FGm0YwEDVrJEMhd2+1VEoRKnZR/W0BLgmnUeqt12T/1LUuMbhWHB4BFeDN6UhfqKpvSsK/xY+ocN9YeOwINXLY+u8JTW3pMbNn9bYE3QTpaZaphPlNQF/lB0o9SHnPwZHlvadWJ6tSXYrAfZwL60Jln2oPxpJE3uBVP0WOdUOO4mRQfXOgsfUs/V+M1P4IkiF46yGYSodx8uGEf7Q9gAAtPACtvmfvCWjV7UhPul97UbE0BERNbyCqOfDAp5Cja9ZEUuLpDDNzqzuyErMn56m5uwW/nT0qCxq2O0Dge9wR7GHTNK8w6RPn4NA08FClxjOD9/LK2h1Q1z8DFlPh1RaeWi92EuOB3ic8E99kn9qaROv3d3zg2AGmL1Wn3GSLpJeDWqSLjJQeBHU4sFe5HmyYC8x6QdLA6OHBzQtjnjKToRG3DCpGRpDJrGSPuqAzM39qbeDhmdpIjNX7WfgzetEhOAftSqxaerDgsY6aSA6MMWgEUU2JEyRw2Jx7vcgQqCPbVtIZgeYu9LWxutzncXrKjRuN2pyhpEwJqffGZePL9+jCPVDbplZ9o0HvcR2Q+5k7BZpPt/AT7NsbgG9Ls9whg1Xp5mQBaIl0Iv5N8pCCjd22ny1cLdl4ZMb1vxvGw3jyYS4R4VkxdSjKHo7BWMDcs/kZgL935xgmeA0SpLD+olmyPvNMsuzzJ/0CHRg6oPbilLTTH9SvrVWG3sq5qKZ1YIa43fAjy9YslE38c62Yw8S06LzSFn8QKqBeqQz3kBxqRNuK1GdYww6KaW4thzZEtSwcA89MEMLFaIxIdn+f7YvybFN87AjdYOW+9nX0Ux1WVM/SNprm2ETHfJVmNky1KO7qZjVyFLXGIC8IHHpYyHJ8m/rX4mnj+X/lEG/gzyLEx7skFmWbWGOhv/0SIII1A9PLVle3VeL4jbkB2ohnMtP6QvCGLQCE=" in [Source : 00000000-00000320.00000000.67901.01E50000.00000004.mdmp]29:T10cf,Found string "[PRIVATE KEY LOCATION: "{0}"]" (Indicator: "private key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Private key passed - public key expected." (Indicator: "private key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Private key passed - public key expected." (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Public Key:" (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Public key presented not for certificate signature" (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Public key certificate for attribute certificate cannot be searched." (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Subject public key cannot be decoded." (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Public key of issuer certificate of CRL could not be retrieved." (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Attribute certificate issuer is also a public key certificate issuer." (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Public key certificate specified in base certificate ID for attribute certificate cannot be found." (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Certification path for public key certificate of attribute certificate could not be build." (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Trusted CA Public Key:" (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "expected public key" (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Unrecognized curve OID for GostR3410x2001 private key" (Indicator: "private key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "algorithm identifier in private key not recognised" (Indicator: "private key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "error recovering GOST3410_2001 public key" (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "invalid length for GOST3410_2001 public key" (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "error recovering GOST3410_94 public key" (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "error recovering GOST3410_2012 public key" (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "invalid length for GOST3410_2012 public key" (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "algorithm identifier in public key not recognised:" (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Expected a public key" (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Expected a private key" (Indicator: "private key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "invalid DH public key" (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "OID is not a valid public key parameter set" (Indicator: "public key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "EOF encountered in middle of Ed25519 private key" (Indicator: "private key"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin")2a:T422,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains long base64 encoded strings Matched sigs: Found long base64 string in memory (encrypted/encoded data) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to perform encryption (API string) Matched sigs: YARA signature match - Cryptography Rijndael Matched sigs: YARA signature match - AES Encryption Matched sigs: YARA signature match - RC4 Encryption2b:T159a,".exe" called "NtQueryInformationProcess" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtQuerySystemInformation" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtAllocateVirtualMemory" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtOpenDirectoryObject" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtQueryVolumeInformationFile" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtQueryAttributesFile" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtCreateSection" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtMapViewOfSection" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtDelayExecution" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtProtectVirtualMemory" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtOpenSection" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtRequestWaitReplyPort" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtCreateMutant" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtCreateEvent" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtQueryInformationToken" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtSetInformationProcess" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtDeviceIoControlFile" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtCreateFile" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtQueryDefaultLocale" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtUnmapViewOfSection" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtOpenEvent" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtOpenProcess" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtOpenProcessToken" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtResumeThread" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtQueryVirtualMemory" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtOpenThreadToken" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtWaitForMultipleObjects" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtCreateThreadEx" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtOpenFile" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtSetInformationThread" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtAlpcSendWaitReceivePort" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtAdjustPrivilegesToken" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtReadVirtualMemory" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtOpenKeyEx" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtQueryValueKey" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtQueryInformationFile" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtQueryKey" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtEnumerateKey" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtEnumerateValueKey" (PID: 320) (UID: 00000000-00000320) ".exe" called "GetProcAddress" (PID: 320) (UID: 00000000-00000320) ".exe" called "LdrGetProcedureAddress" (PID: 320) (UID: 00000000-00000320) ".exe" called "LdrGetDllHandle" (PID: 320) (UID: 00000000-00000320) ".exe" called "LdrLoadDll" (PID: 320) (UID: 00000000-00000320) ".exe" called "LoadLibrary" (PID: 320) (UID: 00000000-00000320) ".exe" called "LdrUnloadDll" (PID: 320) (UID: 00000000-00000320) ".exe" called "GetVersionExA" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtReadFile" (PID: 320) (UID: 00000000-00000320) ".exe" called "CryptHashData" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtConnectPort" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtQuerySystemTime" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtAlertThread" (PID: 320) (UID: 00000000-00000320) ".exe" called "CryptAcquireContextW" (PID: 320) (UID: 00000000-00000320) ".exe" called "NtYieldExecution" (PID: 320) (UID: 00000000-00000320) ".exe" called "FindFirstFileW" (PID: 320) (UID: 00000000-00000320) ".exe" called "RtlGetNtProductType" (PID: 320) (UID: 00000000-00000320) ".exe" called "RtlGetVersion" (PID: 320) (UID: 00000000-00000320) ".exe" called "FindNextFileW" (PID: 320) (UID: 00000000-00000320) ".exe" called "IsWow64Process" (PID: 320) (UID: 00000000-00000320) ".exe" called "CreateDirectoryW" (PID: 320) (UID: 00000000-00000320) ".exe" called "CreateToolhelp32Snapshot" (PID: 320) (UID: 00000000-00000320) ".exe" called "AdjustTokenPrivileges" (PID: 320) (UID: 00000000-00000320) ".exe" called "GetWindowTextW" (PID: 320) (UID: 00000000-00000320) ".exe" called "CreateCompatibleBitmap" (PID: 320) (UID: 00000000-00000320) ".exe" called "LoadResource" (PID: 320) (UID: 00000000-00000320) ".exe" called "GetLocaleInfoW" (PID: 320) (UID: 00000000-00000320)2c:T2dce,".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000320) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000320)2d:T1573,"Software\Microsoft\Windows\CurrentVersion\Run" in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions" in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "BraveSoftware\Brave-Browser\User Data\Local State" in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Software\Microsoft\Internet Explorer\IntelliForms\Storage2" in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Opera Software\Opera GX Stable\Login Data" in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Opera Software\Opera GX Stable\Local State" in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Opera Software\Opera Stable\Login Data" in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Opera Software\Opera Stable\Local State" in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000320.00000000.67901.003C0000.00000004.mdmp 00000000-00000320.00000001.69822.003C0000.00000004.mdmp 00000000-00000320.00000002.71739.003C0000.00000004.mdmp 00000000-00000320.00000003.77258.003C0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00000320.00000000.67901.003C0000.00000004.mdmp 00000000-00000320.00000001.69822.003C0000.00000004.mdmp 00000000-00000320.00000002.71739.003C0000.00000004.mdmp 00000000-00000320.00000003.77258.003C0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\S" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00000320.00000000.67901.7F6F0000.00000002.mdmp 00000000-00000320.00000001.69822.7F6F0000.00000002.mdmp 00000000-00000320.00000002.71739.7F6F0000.00000002.mdmp 00000000-00000320.00000003.77258.7F6F0000.00000002.mdmp2e:T1174,"Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000320.00000000.67901.003C0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00000320.00000000.67901.003C0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\S" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00000320.00000000.67901.01E50000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00000320.00000000.67901.7F6F0000.00000002.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000320.00000001.69822.003C0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00000320.00000001.69822.003C0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00000320.00000001.69822.7F6F0000.00000002.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000320.00000002.71739.003C0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00000320.00000002.71739.003C0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00000320.00000002.71739.7F6F0000.00000002.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000320.00000003.77258.003C0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00000320.00000003.77258.003C0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00000320.00000003.77258.7F6F0000.00000002.mdmp2f:T1735,".exe" loaded module "%WINDIR%\System32\ntdll.dll" at 775A0000 ".exe" loaded module "C:\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe" at 00F20000 ".exe" loaded module "%WINDIR%\System32\mscoree.dll" at 6D2E0000 ".exe" loaded module "%WINDIR%\System32\kernel32.dll" at 75DD0000 ".exe" loaded module "%WINDIR%\System32\msvcrt.dll" at 77390000 ".exe" loaded module "%WINDIR%\System32\sechost.dll" at 77030000 ".exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 759C0000 ".exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 6D290000 ".exe" loaded module "%WINDIR%\System32\ws2_32.dll" at 77760000 ".exe" loaded module "%WINDIR%\System32\nsi.dll" at 770B0000 ".exe" loaded module "%WINDIR%\System32\fltLib.dll" at 6DA00000 ".exe" loaded module "%WINDIR%\System32\api-ms-win-core-synch-l1-2-0.dll" at 72CB0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" at 6D1B0000 ".exe" loaded module "%WINDIR%\System32\shlwapi.dll" at 770C0000 ".exe" loaded module "%WINDIR%\System32\version.dll" at 74A20000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" at 68220000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" at 689D0000 ".exe" loaded module "%WINDIR%\System32\vcruntime140_clr0400.dll" at 72DD0000 ".exe" loaded module "%WINDIR%\System32\ucrtbase_clr0400.dll" at 6D100000 ".exe" loaded module "%WINDIR%\Globalization\Sorting\SortDefault.nls" at 03E50000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 675C0000 ".exe" loaded module "%WINDIR%\System32\rpcss.dll" at 00370000 ".exe" loaded module "%WINDIR%\System32\cryptbase.dll" at 753A0000 ".exe" loaded module "%WINDIR%\System32\uxtheme.dll" at 73FC0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" at 6D010000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" at 669B0000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" at 65B40000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" at 6D9E0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp" at 045E0000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" at 65320000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" at 65210000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" at 64A90000 ".exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 74FC0000 ".exe" loaded module "%WINDIR%\System32\cryptsp.dll" at 74EB0000 ".exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 00430000 ".exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 74C40000 ".exe" loaded module "%WINDIR%\System32\psapi.dll" at 776F0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 644E0000 ".exe" loaded module "%WINDIR%\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" at 048C0000 ".exe" loaded module "%WINDIR%\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" at 74320000 ".exe" loaded module "%WINDIR%\WindowsShell.Manifest" at 00440000 ".exe" loaded module "%WINDIR%\System32\dwmapi.dll" at 73F00000 ".exe" loaded module "%WINDIR%\System32\KernelBase.dll" at 754E0000 ".exe" loaded module "%WINDIR%\System32\advapi32.dll" at 76F60000 ".exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 6D240000 ".exe" loaded module "%WINDIR%\System32\user32.dll" at 76BD0000 ".exe" loaded module "%WINDIR%\System32\gdi32.dll" at 77710000 ".exe" loaded module "%WINDIR%\System32\lpk.dll" at 77700000 ".exe" loaded module "%WINDIR%\System32\usp10.dll" at 772F0000 ".exe" loaded module "%WINDIR%\System32\ole32.dll" at 77440000 ".exe" loaded module "%WINDIR%\System32\oleaut32.dll" at 75A70000 ".exe" loaded module "%WINDIR%\System32\imm32.dll" at 002C0000 ".exe" loaded module "%WINDIR%\System32\imm32.dll" at 77010000 ".exe" loaded module "%WINDIR%\System32\msctf.dll" at 76B00000 ".exe" loaded module "C:\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe" at 00B30000 ".exe" loaded module "%WINDIR%\System32\api-ms-win-core-xstate-l2-1-0.dll" at 6E520000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" at 66B60000 ".exe" loaded module "%WINDIR%\System32\shell32.dll" at 75EB0000 ".exe" loaded module "%WINDIR%\System32\profapi.dll" at 754B0000 ".exe" loaded module "%WINDIR%\System32\en-US\user32.dll.mui" at 0047000030:T1f70,Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00000320-00000C1E-37085891] Observed system executable string:"C:\Windows\Temp\VxOle32.dll" [Source: 00000000-00000320.00000000.67901.00010000.00000040.mdmp 00000000-00000320.00000000.67901.002B0000.00000002.mdmp 00000000-00000320.00000001.69822.00010000.00000040.mdmp 00000000-00000320.00000001.69822.002B0000.00000002.mdmp 00000000-00000320.00000002.71739.00010000.00000040.mdmp 00000000-00000320.00000002.71739.002B0000.00000002.mdmp 00000000-00000320.00000003.77258.00010000.00000040.mdmp 00000000-00000320.00000003.77258.002B0000.00000002.mdmp] Observed system executable string:"C:\Windows\Temp\VxSSL32.dll" [Source: 00000000-00000320.00000000.67901.00020000.00000040.mdmp 00000000-00000320.00000000.67901.00190000.00000002.mdmp 00000000-00000320.00000001.69822.00020000.00000040.mdmp 00000000-00000320.00000001.69822.00190000.00000002.mdmp 00000000-00000320.00000002.71739.00020000.00000040.mdmp 00000000-00000320.00000002.71739.00190000.00000002.mdmp 00000000-00000320.00000003.77258.00020000.00000040.mdmp 00000000-00000320.00000003.77258.00190000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\sxsoa.dll" [Source: 00000000-00000320.00000000.67901.00030000.00000002.mdmp 00000000-00000320.00000001.69822.00030000.00000002.mdmp 00000000-00000320.00000002.71739.00030000.00000002.mdmp 00000000-00000320.00000003.77258.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\GdiPlus.dll" [Source: 00000000-00000320.00000000.67901.00030000.00000002.mdmp 00000000-00000320.00000001.69822.00030000.00000002.mdmp 00000000-00000320.00000002.71739.00030000.00000002.mdmp 00000000-00000320.00000003.77258.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\comctl32.dll" [Source: 00000000-00000320.00000000.67901.00030000.00000002.mdmp 00000000-00000320.00000001.69822.00030000.00000002.mdmp 00000000-00000320.00000002.71739.00030000.00000002.mdmp 00000000-00000320.00000003.77258.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\sxsoaps.dll" [Source: 00000000-00000320.00000000.67901.00030000.00000002.mdmp 00000000-00000320.00000001.69822.00030000.00000002.mdmp 00000000-00000320.00000002.71739.00030000.00000002.mdmp 00000000-00000320.00000003.77258.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\comctl32.dll.mui" [Source: 00000000-00000320.00000000.67901.00030000.00000002.mdmp 00000000-00000320.00000001.69822.00030000.00000002.mdmp 00000000-00000320.00000002.71739.00030000.00000002.mdmp 00000000-00000320.00000003.77258.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll.101.Config" [Source: 00000000-00000320.00000000.67901.00160000.00000004.mdmp 00000000-00000320.00000001.69822.00160000.00000004.mdmp 00000000-00000320.00000002.71739.00160000.00000004.mdmp 00000000-00000320.00000003.77258.00160000.00000004.mdmp] Observed system executable string:":\Windows\SYSTEM32\ntdll.dll" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\system32\KERNEL32.dll" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\system32\KERNELBASE.dll" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\SYSTEM32\MSCOREE.DLL" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\system32\RPCRT4.dll" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\system32\ADVAPI32.dll" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\system32\msvcrt.dll" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\SYSTEM32\sechost.dll" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\Temp\VxSSL32.dll" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\system32\WS2_32.dll" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\system32\NSI.dll" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\system32\FLTLIB.DLL" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp] Observed system executable string:":\Windows\Temp\VxOle32.dll" [Source: 00000000-00000320.00000000.67901.001A0000.00000004.mdmp 00000000-00000320.00000001.69822.001A0000.00000004.mdmp 00000000-00000320.00000002.71739.001A0000.00000004.mdmp 00000000-00000320.00000003.77258.001A0000.00000004.mdmp]31:T3fba,".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS\V4.0.30319"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319\SKUS\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319\SKUS\DEFAULT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\9BC86D7600883FEA7D2BD5D30EAEF3F7FF8336AC4736CA16EFA3F542A81E7E77.EXE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\FUSION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\NGEN\POLICY\V4.0"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\SERVICING"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\STRONGNAME"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.CONFIGURATION__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.CONFIGURATION__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.XML__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.XML__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\APTCA"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.WINDOWS.FORMS__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.WINDOWS.FORMS__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.SECURITY__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.SECURITY__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.DRAWING__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.DRAWING__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.ACCESSIBILITY__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.ACCESSIBILITY__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.CORE__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.CORE__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.DEPLOYMENT__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.DEPLOYMENT__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.RUNTIME.SERIALIZATION.FORMATTERS.SOAP__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.RUNTIME.SERIALIZATION.FORMATTERS.SOAP__B03F5F7F11D50A3A"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.NUMERICS__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.NUMERICS__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\APPCONTEXT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.DATA.SQLXML__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.DATA.SQLXML__B77A5C561934E089"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-2092356043-4041700817-663127204-1001"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PROPERTYBAG"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PROPERTYBAG"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KNOWNFOLDERSETTINGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 024"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DESHASHSESSIONKEYBACKWARD"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\XML"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK\XML"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319\SYSTEM.NET.SERVICEPOINTMANAGER.USEHTTPPIPELININGANDBUFFERPOOLING"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319\SYSTEM.NET.SERVICEPOINTMANAGER.USESAFESYNCHRONOUSCLOSE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319\SYSTEM.NET.SERVICEPOINTMANAGER.USESTRICTRFCINTERIMRESPONSEHANDLING"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319\SYSTEM.URI.ALLOWDANGEROUSUNICODEDECOMPOSITIONS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319\SYSTEM.URI.USESTRICTIPV6ADDRESSPARSING"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319\SYSTEM.URI.ALLOWALLURIENCODINGEXPANSION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319\SYSTEM.NET.SERVICEPOINTMANAGER.SCHSENDAUXRECORD"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319\SYSTEM.NET.SERVICEPOINTMANAGER.REQUIRECERTIFICATEEKUS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319\SYSTEM.NET.SERVICEPOINTMANAGER.SECURITYPROTOCOL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "")32:T4b58,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "319DC449-ADA5-50F7-428E-957DB6791668"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL"; Key: "RELEASE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "9BC86D7600883FEA7D2BD5D30EAEF3F7FF8336AC4736CA16EFA3F542A81E7E77"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "DISABLECONFIGCACHE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "763FD754-7086-4DFE-95EB-C01A46FAF4CA"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A669021C-C450-4609-A035-5AF59AF4DF18"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CC2BCBBA-16B6-4CF3-8990-D74C2E8AF500"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "CACHELOCATION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "DOWNLOADCACHEQUOTAINKB"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "ENABLELOG"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "LOGGINGLEVEL"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "FORCELOG"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "LOGFAILURES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "LOGRESOURCEBINDS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "FILEINUSERETRYATTEMPTS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "FILEINUSEMILLISECONDSBETWEENRETRIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "USELEGACYIDENTITYFORMAT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "DISABLEMSIPEEK"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DEVOVERRIDEENABLE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\NGEN\POLICY\V4.0"; Key: "OPTIMIZEUSEDBINARIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "FEATURESIMD"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ALTJIT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT"; Key: "LATEST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT"; Key: "INDEX303"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT"; Key: "LEGACYPOLICYTIMESTAMP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION"; Key: "INSTALLATIONTYPE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "CATEGORY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "NAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "PARENTFOLDER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "DESCRIPTION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "RELATIVEPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "PARSINGNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "INFOTIP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "LOCALIZEDNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "ICON"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "SECURITY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "STREAMRESOURCE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "STREAMRESOURCETYPE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "LOCALREDIRECTONLY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "ROAMABLE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "PRECREATE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "STREAM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "PUBLISHEXPANDEDPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "ATTRIBUTES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "FOLDERTYPEID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"; Key: "INITFOLDERHANDLER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: "APPDATA"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "CATEGORY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "NAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "PARENTFOLDER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "DESCRIPTION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "RELATIVEPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "PARSINGNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "INFOTIP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "LOCALIZEDNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "ICON"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "SECURITY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "STREAMRESOURCE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "STREAMRESOURCETYPE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "LOCALREDIRECTONLY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "ROAMABLE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "PRECREATE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "STREAM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "PUBLISHEXPANDEDPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "ATTRIBUTES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "FOLDERTYPEID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}"; Key: "INITFOLDERHANDLER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-2092356043-4041700817-663127204-1001"; Key: "PROFILEIMAGEPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST"; Key: "DEFAULT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 024"; Key: "NAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: "TYPE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER"; Key: "IMAGE PATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEPROCESSSEARCHMODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\CRYPTOGRAPHY"; Key: "PRIVKEYCACHEMAXITEMS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\CRYPTOGRAPHY"; Key: "PRIVKEYCACHEPURGEINTERVALSECONDS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\CRYPTOGRAPHY"; Key: "PRIVATEKEYLIFETIMESECONDS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319"; Key: "HWRPORTREUSEONSOCKETBIND"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319"; Key: "USEHTTPPIPELININGANDBUFFERPOOLING"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319"; Key: "USESAFESYNCHRONOUSCLOSE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319"; Key: "USESTRICTRFCINTERIMRESPONSEHANDLING"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319"; Key: "ALLOWDANGEROUSUNICODEDECOMPOSITIONS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319"; Key: "USESTRICTIPV6ADDRESSPARSING"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319"; Key: "ALLOWALLURIENCODINGEXPANSION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319"; Key: "SCHUSESTRONGCRYPTO"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319"; Key: "SCHSENDAUXRECORD"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319"; Key: "SYSTEMDEFAULTTLSVERSIONS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\V4.0.30319"; Key: "REQUIRECERTIFICATEEKUS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")33:T4572,".exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" ".exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" ".exe" trying to touch file "C:\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" trying to touch file "C:\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe.config" ".exe" trying to touch file "C:\Windows\system32\VERSION.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to touch file "C:\Windows\system32\VCRUNTIME140_CLR0400.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to touch file "C:\Windows\system32\ucrtbase_clr0400.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" ".exe" trying to touch file "C:\Windows\system32\rpcss.dll" ".exe" trying to touch file "C:\CRYPTBASE.dll" ".exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" ".exe" trying to touch file "\Device\KsecDD" ".exe" trying to touch file "C:\Windows\system32\uxtheme.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Client\" ".exe" trying to touch file "C:\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.INI" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\0b2f69b43a576b9edcc807a30872bd91\System.ni.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" ".exe" trying to touch file "C:\Users\%OSUSER%" ".exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming" ".exe" trying to touch file "C:\Users\Default\AppData\Roaming" ".exe" trying to touch file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" ".exe" trying to touch file "C:\CRYPTSP.dll" ".exe" trying to touch file "C:\Windows\system32\CRYPTSP.dll" ".exe" trying to touch file "C:\Windows\system32\rsaenh.dll" ".exe" trying to touch file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" ".exe" trying to touch file "C:\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe.Local\" ".exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" ".exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" ".exe" trying to touch file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" ".exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" ".exe" trying to touch file "C:\Windows\System32\fltLib.dll" ".exe" trying to touch file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to touch file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" ".exe" trying to touch file "C:\Windows\system32\IMM32.DLL" ".exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to touch file "C:\Windows\system32\combase.dll" ".exe" trying to touch file "C:\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" ".exe" trying to touch file "C:\Windows\system32\bcrypt.dll" ".exe" trying to touch file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" ".exe" trying to touch file "C:\dwmapi.dll" ".exe" trying to touch file "C:\Windows\system32\dwmapi.dll" ".exe" trying to touch file "C:\Windows\System32\imm32.dll" ".exe" trying to touch file "%WINDIR%\System32\mscoree.dll" ".exe" trying to touch file "%WINDIR%\System32\sechost.dll" ".exe" trying to touch file "%WINDIR%\Temp\VxSSL32.dll" ".exe" trying to touch file "%WINDIR%\System32\fltLib.dll" ".exe" trying to touch file "%WINDIR%\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to touch file "%WINDIR%\System32\api-ms-win-core-synch-l1-2-0.dll" ".exe" trying to touch file "%WINDIR%\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" ".exe" trying to touch file "%WINDIR%\System32\version.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" ".exe" trying to touch file "%WINDIR%\System32\vcruntime140_clr0400.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" ".exe" trying to touch file "%WINDIR%\System32\ucrtbase_clr0400.dll" ".exe" trying to touch file "%WINDIR%\System32\API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" ".exe" trying to touch file "%WINDIR%\Globalization\Sorting\SortDefault.nls" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" ".exe" trying to touch file "%WINDIR%\System32\rpcss.dll" ".exe" trying to touch file "C:\CRYPTBASE.DLL" ".exe" trying to touch file "%WINDIR%\System32\cryptbase.dll" ".exe" trying to touch file "%WINDIR%\System32\uxtheme.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\CLIENT" ".exe" trying to touch file "C:\9BC86D7600883FEA7D2BD5D30EAEF3F7FF8336AC4736CA16EFA3F542A81E7E77.INI" ".exe" trying to touch file "%WINDIR%\System32\api-ms-win-core-xstate-l2-1-0.dll" ".exe" trying to touch file "%WINDIR%\assembly\pubpol303.dat" ".exe" trying to touch file "%WINDIR%\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_32\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DLL" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\0b2f69b43a576b9edcc807a30872bd91\System.ni.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\0b2f69b43a576b9edcc807a30872bd91\System.ni.dll.aux" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll.aux" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_32\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll.aux" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_32\SYSTEM.DRAWING\V4.0_4.0.0.0__B03F5F7F11D50A3A\SYSTEM.DRAWING.DLL" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll.aux" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll.aux" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll.aux" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" ".exe" trying to touch file "%USERPROFILE%\AppData\Roaming" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" ".exe" trying to touch file "%WINDIR%\System32\bcrypt.dll" ".exe" trying to touch file "C:\CRYPTSP.DLL" ".exe" trying to touch file "%WINDIR%\System32\cryptsp.dll" ".exe" trying to touch file "%WINDIR%\System32\rsaenh.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\PSAPI.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" ".exe" trying to touch file "C:\9BC86D7600883FEA7D2BD5D30EAEF3F7FF8336AC4736CA16EFA3F542A81E7E77.EXE.LOCAL" ".exe" trying to touch file "%WINDIR%\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" ".exe" trying to touch file "%WINDIR%\WindowsShell.Manifest" ".exe" trying to touch file "%WINDIR%\System32\dwmapi.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL" ".exe" trying to touch file "%WINDIR%\Temp\VxOle32.dll" ".exe" trying to touch file "%WINDIR%\System32\imm32.dll" ".exe" trying to touch file "%WINDIR%\System32\MSCOREE.DLL.LOCAL" ".exe" trying to touch file "%WINDIR%\System32\API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" ".exe" trying to touch file "%WINDIR%\System32\API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" ".exe" trying to touch file "%WINDIR%\System32\COMBASE.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll" ".exe" trying to touch file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll.aux" ".exe" trying to touch file "C:\9BC86D7600883FEA7D2BD5D30EAEF3F7FF8336AC4736CA16EFA3F542A81E7E77.EXE.CONFIG" ".exe" trying to touch file "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UXTHEME.DLL" ".exe" trying to touch file "C:\DWMAPI.DLL" ".exe" trying to touch file "%WINDIR%\System32\en-US\user32.dll.mui"34:Tb3c,".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" ".exe" trying to access non-existent file "C:\CRYPTSP.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\system32\combase.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" ".exe" trying to access non-existent file "C:\dwmapi.dll"35:T1531,Heuristic match: "Org.BouncyCastle.Asn1.UA" Heuristic match: "Org.BouncyCastle.Math.EC" Heuristic match: "Org.BouncyCastle.Crypto.EC" Heuristic match: "Org.BouncyCastle.Asn1.GM" Heuristic match: "Org.BouncyCastle.Math.EC.Custom.GM" Heuristic match: "Org.BouncyCastle.Crypto.IO" Heuristic match: "Org.BouncyCastle.Utilities.IO" Pattern match: "https://ipwho.is/" Pattern match: "https://stackoverflow.com/q/11564914/23354" Pattern match: "https://stackoverflow.com/q/14436606/23354" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "PATHEXT=.COM;.EXE;.BAT;.CM" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\SYSTEM32\\MSCOREE.DLL"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\SYSTEM32\\sechost.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\FLTLIB.DLL" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\FLTLIB.DLL"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\SYSTEM32\\MSCOREE.DLL.local" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\VERSION.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\VCRUNTIME140_CLR0400.dll" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\VCRUNTIME140_CLR0400.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ucrtbase_clr0400.dll" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\ucrtbase_clr0400.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\api-ms-win-core-quirks-l1-1-0.dll" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\api-ms-win-appmodel-runtime-l1-1-2.dll" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoree.dll" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\rpcss.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\CRYPTBASE.dll" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\CRYPTBASE.dll"}37:Tb04,".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "180" "DesiredAccess": "8" "TokenHandle": "172"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "264"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "356" "$name": "C:\\Windows\\System32\\rpcss.dll"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "352" "DesiredAccess": "8" "TokenHandle": "360" "$name": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "33554432" "TokenHandle": "40"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "496" "$name": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\96f7edb07b12303f0ec2595c7f3778c7\\System.Configuration.ni.dll"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "560" "$name": "C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\\comctl32.dll"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "32" "TokenHandle": "556" "$name": "C:\\Windows\\System32\\cryptsp.dll"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "33554432" "TokenHandle": "552" "$name": "C:\\Windows\\System32\\rsaenh.dll"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "10" "TokenHandle": "572"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "24"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "10" "TokenHandle": "84"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "172" "DesiredAccess": "8" "TokenHandle": "176"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "172" "DesiredAccess": "8" "TokenHandle": "180"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "131080" "TokenHandle": "352" "$name": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls"} ".exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "524"}38:T51d,".exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "4" "OpenAsSelf": "1" "TokenHandle": "4294967295" "$status": "c000007c"} ".exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "33554432" "OpenAsSelf": "1" "TokenHandle": "4294967295" "$status": "c000007c"} ".exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "33554432" "OpenAsSelf": "0" "TokenHandle": "4294967295" "$status": "c000007c"} ".exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "8" "OpenAsSelf": "1" "TokenHandle": "4294967295" "$status": "c000007c"} ".exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "12" "OpenAsSelf": "1" "TokenHandle": "0" "$status": "c000007c"} ".exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "8" "OpenAsSelf": "1" "TokenHandle": "0" "$status": "c000007c"} ".exe" called "NtOpenThreadToken" with parameters {"ThreadHandle": "4294967294" "DesiredAccess": "8" "OpenAsSelf": "0" "TokenHandle": "0" "$status": "c000007c"}39:T749,Found string "passwordBasedMac" (Indicator: "password"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "password_value" (Indicator: "password"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Export of key material requires extended_master_secret" (Indicator: "secret"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "no password supplied when one expected" (Indicator: "password"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "cannot export keying material without extended_master_secret" (Indicator: "secret"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "BCrypt password must be <= 72 bytes" (Indicator: "password"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "Missing password." (Indicator: "password"; File: "9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00000320.00000000.67901.01E50000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00000320.00000000.67901.01E50000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00000320.00000000.67901.01E50000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00000320.00000000.67901.01E50000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00000320.00000000.67901.01E50000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00000320.00000000.67901.01E50000.00000004.mdmp")3a:T1849,".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "16" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "303104" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "12" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "872448" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\mscoree.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "12" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "1048576" "InheritDisposition": "2" "AllocationType": "4194304" "Protect": "2" "$name": "C:\\Windows\\System32\\mscoree.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "28" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "704512" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\sechost.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "36" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "102400" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "28" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "663552" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\sechost.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "56" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "286720" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "52" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "217088" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "\\FileSystem\\Filters\\FltMgrMsg"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "52" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "24576" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "\\FileSystem\\Filters\\FltMgrMsg"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "64" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "28672" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\imm32.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "56" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "577536" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "124" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "356352" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "136" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "3268608" "InheritDisposition": "1" "AllocationType": "0" "Protect": "2"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "136" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "36864" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "136" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "8056832" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "136" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "81920" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "136" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "700416" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "180" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "65536" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "268" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "20480" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "356" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "2945024" "InheritDisposition": "1" "AllocationType": "0" "Protect": "2" "$name": "C:\\Windows\\System32\\rpcss.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "432" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "21016576" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "\\Device\\KsecDD"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "428" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "380928" "InheritDisposition": "1" "AllocationType": "0" "Protect": "2" "$name": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "436" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "49152" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\uxtheme.dll"}3b:T80b,"BraveSoftware\Brave-Browser\User Data\Default\Login Data" (Indicator: "bravesoftware\brave-browser\user data") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "BraveSoftware\Brave-Browser\User Data\Local State" (Indicator: "bravesoftware\brave-browser\user data") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Google\Chrome\User Data\Default\Login Data" (Indicator: "google\chrome\user data") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Google\Chrome\User Data\Local State" (Indicator: "google\chrome\user data") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Microsoft\Edge\User Data\Default\Login Data" (Indicator: "microsoft\edge\user data") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Microsoft\Edge\User Data\Local State" (Indicator: "microsoft\edge\user data") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Mozilla\Firefox\Profiles" (Indicator: "mozilla\firefox\") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Opera Software\Opera GX Stable\Login Data" (Indicator: "opera software\opera gx stable\login data") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Opera Software\Opera Stable\Login Data" (Indicator: "opera software\opera stable\login data") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Opera Software\Opera Stable\Local State" (Indicator: "opera software\opera stable\local state") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Yandex\YandexBrowser\User Data\Default\Ya Passman Data" (Indicator: "yandex\yandexbrowser\user data") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin "Yandex\YandexBrowser\User Data\Local State" (Indicator: "yandex\yandexbrowser\user data") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin3c:T87c,"007062299.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "007062299.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "007062299.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "007062299.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\b138f79dea860272ebe6694d9b73f656\system.windows.forms.ni.dll.aux" "007062299.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\ece80f2e3752a779e894fd45d8f27e64\system.drawing.ni.dll.aux" "007062299.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\system.configuration.ni.dll.aux" "007062299.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "007062299.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\5ee35debfc22f727e70e4479ddcbc045\system.xml.ni.dll.aux" "007062299.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "007062299.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "007062299.exe" reads file "c:\users\%osuser%\music\desktop.ini" "007062299.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "007062299.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "007062299.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "007062299.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "007062299.exe" reads file "c:\users\%osuser%\appdata\local\iconcache.db" "007062299.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.servicemodel\3b9cf8abf6d42fe62158f8da994ecc20\system.servicemodel.ni.dll.aux" "007062299.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.runteb92aa12#\59a4984a6afe6b209eaaa379927ab81d\system.runtime.serialization.ni.dll.aux" "007062299.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\accessibility\af089aca36389b4c976815f39c9d7669\accessibility.ni.dll.aux"3d:T28ff,Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00006328.00000000.78430.1DC82000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00006328.00000000.78430.1DC82000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00006328.00000000.78430.1DC82000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00006328.00000000.78430.1DC82000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00006328.00000000.78430.1DC82000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00006328.00000000.78430.1DC82000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00006328.00000000.78430.1DC82000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00006328.00000000.78430.1DC82000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00006328.00000000.78430.1DC82000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00006328.00000000.78430.1DC82000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00006328.00000000.78430.1DC82000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00006328.00000000.78430.1DC82000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00006328.00000001.80349.1DC82000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00006328.00000001.80349.1DC82000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00006328.00000001.80349.1DC82000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00006328.00000001.80349.1DC82000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00006328.00000001.80349.1DC82000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00006328.00000001.80349.1DC82000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00006328.00000001.80349.1DC82000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00006328.00000001.80349.1DC82000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00006328.00000001.80349.1DC82000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00006328.00000001.80349.1DC82000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00006328.00000001.80349.1DC82000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00006328.00000001.80349.1DC82000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00006328.00000002.82271.1DC82000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00006328.00000002.82271.1DC82000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00006328.00000002.82271.1DC82000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00006328.00000002.82271.1DC82000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00006328.00000002.82271.1DC82000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00006328.00000002.82271.1DC82000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00006328.00000002.82271.1DC82000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00006328.00000002.82271.1DC82000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00006328.00000002.82271.1DC82000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00006328.00000002.82271.1DC82000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00006328.00000002.82271.1DC82000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00006328.00000002.82271.1DC82000.00000004.mdmp") Found URL "https://npcap.com/.exe\" called \"LoadResource with parameter \" (UID: 00000000-00000320)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/3\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/3\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains long base64 encoded strings","description":"$28","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-500","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000320.00000000.67901.00F20000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000320.00000001.69822.00F20000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000320.00000002.71739.00F20000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000320.00000003.77258.00F20000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000320.00000000.67901.01E50000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000320.00000000.67901.01E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000320.00000000.67901.01E50000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00000320.00000000.67901.01E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$29","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains long base64 encoded strings\n Matched sigs: Found long base64 string in memory (encrypted/encoded data)\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2a","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES Encryption\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" (UID: 00000000-00000320)\n \".exe\" called \"IsWow64Process\" with parameter \"320\" - (UID: 00000000-00000320)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\".exe\" called \"GetWindowTextW\" (UID: 00000000-00000320)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00000320)\n \".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000320)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" (UID: 00000000-00000320)\n \".exe\" called \"RtlGetVersion\" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000009d006b01000000000000000000000000000000000000140098006b0100000000000000000000f86c1a0000000000200000000000000000000000904a1c00e8691a00086b1a00f8b61c00b06e1a0048f65100ecf351001b89e62348f6510095e15b77b6802800feffffffff2b5f779a2a5f7764c53477b69f5f7700000000000000000000000000000000000000000000000001000000000000000000717700000000f0f4510000000000000000000000000004f5510000000000000000000000000000000000d7939b4ef8f45100020000000000000064c53477f8b61c0064c53477 (UID: 00000000-00000320)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\".exe\" called \"GetVersionExA\" (UID: 00000000-00000320)\n \".exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f0cd1c005cf65100145c5f77435c5f7728f751000100000094011a0001000000dcf55100935c607740836777d4a05f777a69267728f75100010000000100000078791c0000000000acf55100dcf5510048f6510095e15b775e982800feffffffd4a05f771bbe4e7500002f7700000000 (UID: 00000000-00000320)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" (UID: 00000000-00000320)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe\" at 00000000-00000320-0000010C-23301288","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Calls an API during runtime","description":"$2b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-265","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryW\" (UID: 00000000-00000320)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\".exe\" called \"LoadLibrary\" with a parameter gdi32.dll (UID: 00000000-00000320)\n \".exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\IMM32.DLL (UID: 00000000-00000320)\n \".exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000320)\n \".exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000320)\n \".exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00000320)\n \".exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000320)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT Caption FROM Win32_OperatingSystem\" (Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin, Indicator: \"select caption from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"CreateDC\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")\n Found reference to API (Indicator: \"DeleteDC\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")\n Found reference to API (Indicator: \"CryptHashData\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")\n Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")\n Found reference to API (Indicator: \"GetWindowThreadProcessId\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")\n Found reference to API (Indicator: \"AddDllDirectory\"; Source: \"00000000-00000320.00000000.67901.01E50000.00000004.mdmp\")\n Found reference to API (Indicator: \"DefWindowProcW\"; Source: \"00000000-00000320.00000000.67901.01E50000.00000004.mdmp\")\n Found reference to API (Indicator: \"DefWindowProcA\"; Source: \"00000000-00000320.00000000.67901.01E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\".exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \".exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$2e","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"Are you mixing protobuf-net and protobuf-csharp-port? See https://stackoverflow.com/q/11564914/23354; type:\" (Indicator: \"stackoverflow.com\")\n \"; please see https://stackoverflow.com/q/14436606/23354\" (Indicator: \"stackoverflow.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Loaded EXE module from outside of Windows folder","description":"\".exe\" loaded module \"C:\\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe\" at 00F20000\n \".exe\" loaded module \"C:\\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe\" at 00B30000","origin":"Loaded Module","mitre_attack_id":"T1574","relevance":1,"id":"module-13","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Loaded modules","description":"$2f","origin":"Loaded Module","mitre_attack_id":"T1574.002","id":"module-11","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"GDI32.DLL\" at base 77710000\n \".exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 77010000\n \".exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 72cb0000\n \".exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 0\n \".exe\" loaded module \"KERNEL32\" at base 75dd0000\n \".exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 0\n \".exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 6d240000\n \".exe\" loaded module \"RPCRT4.DLL\" at base 759c0000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 675C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74FC0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68220000\n \".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 689D0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 759C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\" was detected as \".NET\" and name: \"Library\"\n \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SELECT Caption FROM Win32_OperatingSystem\" (Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin, Indicator: \"select caption from win32_operatingsystem\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Installation/Persistence","name":"Allocates virtual memory in a self process","description":"\".exe\" allocated memory in \"C:\\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe\" with (Protection: \"read/write\")\n \".exe\" allocated memory in \"C:\\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe\" with (Protection: \"read/write, page guard\")\n \".exe\" allocated memory in \"C:\\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe\" with (Protection: \"execute/read/write\")","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-262","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\".exe\" queries basic process information of the \"C:\\Windows\\System32\\cryptsp.dll\" (UID: 320)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"C:\\Windows\\SYSTEM32\\MSCOREE.DLL.local\"\n \".exe\" trying to access non-existent file \"C:\\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe.config\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Client\\\"\n \".exe\" trying to access non-existent file \"C:\\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.INI\"\n \".exe\" trying to access non-existent file \"C:\\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe.Local\\\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\fusion.localgac\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$35","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://ipwho.is\"\n Found HTTPS url \"https://stackoverflow.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on process \"00000000-00000320\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\".exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00000320)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically to used to retrieve file or directory information","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-236","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00000320)\n \".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a process","description":"$37","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-196","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a thread","description":"$38","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-197","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$39","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT Caption FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\".exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000320)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000320.00000000.67901.001A0000.00000004.mdmp, 00000000-00000320.00000001.69822.001A0000.00000004.mdmp, 00000000-00000320.00000002.71739.001A0000.00000004.mdmp, 00000000-00000320.00000003.77258.001A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"\"del /a /q /f \"\" (Indicator: \"\"del \") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilegee\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00000320.00000000.67901.001A0000.00000004.mdmp, 00000000-00000320.00000001.69822.001A0000.00000004.mdmp, 00000000-00000320.00000002.71739.001A0000.00000004.mdmp, 00000000-00000320.00000003.77258.001A0000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00000320.00000000.67901.01E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to map section into the virtual address space of a process","description":"$3a","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-259","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to unmap view of a section from a process","description":"\".exe\" called \"NtUnmapViewOfSection\" with parameters {\"ProcessHandle\": \"4294967295\"}","origin":"API Call","mitre_attack_id":"T1055.012","relevance":1,"id":"api-261","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Antivirus\" (Indicator: \"antivirus\") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00000000-00000320-00000105-3086023","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 320)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses a .NET obfuscator to hide its code","description":"\"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" is a hint for the obfuscator \"MPRESS\"","origin":"File/Memory","mitre_attack_id":"T1140","relevance":2,"id":"string-6","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT Caption FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"52/70 Antivirus vendors marked sample as malicious (74% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.19\"\n \"2.5.29.15\"\n \"2.5.29.37\"\n \"2.5.29.17\"\n \"2.5.29.18\"\n \"1.3.132.0\"\n \"2.5.1.1\"\n Potential IP \"2.4.8.1\" found in string \"2.4.8.1+cce1c58590\"\n \"2.4.0.0\"\n \"1.9.0.1\"\n \"1.4.1.0\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0,\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Numerics,4.0.0.0,,b77a5c561934e089,MSIL\"\n Potential IP \"4.0.0.0\" found in string \"=4.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Cul\"\n Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e08\"\n \"2.5.29.10\"\n \"2.5.29.14\"\n \"4.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Cryptography Rijndael","description":"YARA signature for Rijndael cipher used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-109","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"GetMac\" (Indicator: \"getmac\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")\n Found string \"HostName\" (Indicator: \"hostname\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")\n Found string \"hostname\" (Indicator: \"hostname\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")\n Found string \"'name' is not a HostName string\" (Indicator: \"hostname\"; File: \"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\".exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\System32\\cryptsp.dll\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"DeleteDC\" (Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin, API is part of module: GDI32.DLL)\n Found string \"CryptHashData\" (Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin, API is part of module: CRYPTSP.DLL)\n Found string \"GetCurrentThreadId\" (Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin, API is part of module: KERNELBASE.DLL)\n Found string \"GetWindowThreadProcessId\" (Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin, API is part of module: USER32.DLL)\n Found string \"shutdown\" (Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin, API is part of module: WS2_32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"db4d2e6d00000000\" to virtual address \"0x00F22000\" (part of module \"9BC86D7600883FEA7D2BD5D30EAEF3F7FF8336AC4736CA16EFA3F542A81E7E77.EXE\")\n \".exe\" wrote bytes \"926d207b\" to virtual address \"0x689DF798\" (part of module \"CLR.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"52/70 Antivirus vendors marked sample as malicious (74% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_QuasarStealer\" matched file \"sample.bin\" as \"Detects Quasar infostealer\" (Author: ditekshen)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"\"{0}\\FileZilla\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin\n \"{0}\\FileZilla\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: 9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.bin","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\MountPointManager; Source: \"00000000-00006328.00000000.78430.1E73E000.00000004.mdmp, 00000000-00006328.00000001.80349.1E73E000.00000004.mdmp, 00000000-00006328.00000002.82271.1E73E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00006328.00000000.78430.03450000.00000004.mdmp\n 00000000-00006328.00000001.80349.03450000.00000004.mdmp\n 00000000-00006328.00000002.82271.03450000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"007062299.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"007062299.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"007062299.exe\" touched \"Local Icon Cache\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2155FEE3-2419-4373-B102-6843707EB41F}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to terminate process and its threads","description":"\"007062299.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\007062299.exe\"}","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-247","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"#c:\\windows\\system32\\licensingui.exe\" (Indicator: \"licensingui.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Process deletes itself","description":"\"C:\\007062299.exe\" deletes itself","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"007062299.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"007062299.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"007062299.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"007062299.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"007062299.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"007062299.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"007062299.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00006328.00000000.78430.03BF0000.00000002.mdmp\n 00000000-00006328.00000001.80349.03BF0000.00000002.mdmp\n 00000000-00006328.00000002.82271.03BF0000.00000002.mdmp\n \"!Progman\" (Program manager) in Source: 00000000-00006328.00000000.78430.03BF0000.00000002.mdmp\n 00000000-00006328.00000001.80349.03BF0000.00000002.mdmp\n 00000000-00006328.00000002.82271.03BF0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1547","relevance":5,"id":"string-184","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"007062299.exe\" marked \"C:\\007062299.exe:Zone.Identifier\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"007062299.exe\" opened \"C:\\007062299.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"007062299.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"007062299.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"007062299.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F0\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"007062299.exe\" opened \"C:\\007062299.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Possibly checks for the presence of an Antivirus engine"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":78,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","opensource","quasar","rat","targeted","infostealer","evasive","windows-server-utility"],"sandbox_reports":[{"id":"646f441b2a4cbe92e703c05d","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.MSIL.PasswordStealerA","submit_name":"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe","analysis_start_time":"2023-05-25T11:18:52+00:00","indicators_count":{"informative":76,"suspicious":22,"malicious":5},"is_in_unified_schema":true},{"id":"646f3e113b9e50b14005ccc3","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.MSIL.PasswordStealerA","submit_name":"007062299.exe","analysis_start_time":"2023-05-25T10:53:06+00:00","indicators_count":{"informative":56,"suspicious":21,"malicious":6},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}],"processes":[{"pid":320,"ppid":0,"name":"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe","command_line":"","sha256":"9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77","normalized_path":"C:\\9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77.exe","uid":"00000000-00000320","icon":"$40"}],"all_imported_dlls":["fltLib.dll","clr.dll","mscorlib.ni.dll","rpcss.dll","System.Windows.Forms.ni.dll","nlssorting.dll","bcrypt.dll","psapi.dll","ntdll.dll","kernel32.dll","System.Drawing.ni.dll","usp10.dll","oleaut32.dll","msctf.dll","mscoree.dll","rpcrt4.dll","VxSSL32.dll","api-ms-win-core-synch-l1-2-0.dll","cryptbase.dll","uxtheme.dll","System.Core.ni.dll","KernelBase.dll","user32.dll","gdi32.dll","System.Xml.ni.dll","sechost.dll","ws2_32.dll","mscoreei.dll","shlwapi.dll","clrjit.dll","System.Configuration.ni.dll","cryptsp.dll","version.dll","System.Windows.Forms.dll","comctl32.dll","lpk.dll","imm32.dll","System.ni.dll","shell32.dll","msvcrt.dll","ucrtbase_clr0400.dll","rsaenh.dll","dwmapi.dll","ole32.dll","nsi.dll","vcruntime140_clr0400.dll","advapi32.dll","api-ms-win-core-xstate-l2-1-0.dll","profapi.dll","aepic.dll","thumbcache.dll","win32u.dll","clbcatq.dll","cldapi.dll","MrmCoreR.dll","ntmarta.dll","ucrtbase.dll","System.Runtime.Serialization.ni.dll","combase.dll","policymanager.dll","msvcp_win.dll","powrprof.dll","iertutil.dll","sspicli.dll","System.ServiceModel.ni.dll","mswsock.dll","SHCore.dll","crypt32.dll","cfgmgr32.dll","windows.storage.dll","bcryptprimitives.dll","kernel.appcore.dll","msvcp110_win.dll","Accessibility.ni.dll","gdi32full.dll","msasn1.dll","propsys.dll","WindowsCodecs.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"},{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"646f441b2a4cbe92e703c05d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"646f3e113b9e50b14005ccc3"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["646f441b2a4cbe92e703c05d","646f3e113b9e50b14005ccc3"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.MSIL.Quasar Sample 9bc86d760088… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9bc86d760088…. Malware family: Trojan.MSIL.Quasar. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.MSIL.Quasar Sample 9bc86d760088… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9bc86d760088…. Malware family: Trojan.MSIL.Quasar. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9bc86d7600883fea7d2bd5d30eaef3f7ff8336ac4736ca16efa3f542a81e7e77"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.MSIL.Quasar Sample 9bc86d760088… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9bc86d760088…. Malware family: Trojan.MSIL.Quasar. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L41","11",{}]]