24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 9bf21ab8b013… — Score 75/100 — Hybrid Analysis","description":"Malicious verdict for sample 9bf21ab8b013…. Malware family: Win/malicious_confidence_100%. Threat score 75/100. 10/25 AV engines flagged this file. 2 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d"],"about":{"@type":"SoftwareApplication","name":"bounty-88197275386330222","applicationCategory":["peexe","assembly","executable"],"identifier":"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d","additionalType":"Malicious sample"},"threatScore":75,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":10,"total":25},"behavioralIndicators":{"malicious":2,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T45d,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe"26:T1b12,Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp")27:Tabe,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000c0000e020000000000000000000000000000000000000d00bb000e0200000000000000000000b8788c000000000020000000000000000000000030568e00a8758c00c8768c00c0a98e00707a8c00000000004cf64b0000000000a8f84b004558bf77bb693700feffffff0ce4ba7772e1ba7764c57376d042bb77000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000064c57376c0a98e0064c57376 (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000008c000000000098398c0000000000c92600000000000088388c007f07000000f98f0000000000ff070000000000008000000000000000000000000000000000000000000000000200000290ac8f0000000000000000000000000000000000ff07000000000000dd2600fbc4008c000100000000000000020000000c00000000f98f0000f98f00fbf88f00000000000000000000008c000000000148f322000000000068f922004558bf7793733700feffffff1634bb774134bb7794000000a0000000faf88f00f8f88f0094000000ecf42200b9147b7600000000180000004c779784 (UID: 00000000-00004340)28:Tdef,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPNAMESERVER"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")29:T2b62,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Net.Http\c1f72f0ca85cb675a88efe8f2067f7c8\System.Net.Http.ni.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter 9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00004340)2a:Tab21,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmWINNLSEnableIME (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmWINNLSGetEnableStatus (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmSendIMEMessageExA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmIMPGetIMEA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmIMPQueryIMEA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmIMPSetIMEA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmEscapeA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmEscapeW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmGetCompositionWindow (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmGetDefaultIMEWnd (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmRegisterClient (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmGetCompositionFontA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmSetCompositionFontA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmLockIMC (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmUnlockIMC (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmLoadIME (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmFreeLayout (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmActivateLayout (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmGetCandidateWindow (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmConfigureIMEW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmSetStatusWindowPos (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmGetImeInfoEx (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmLockImeDpi (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmUnlockImeDpi (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmGetOpenStatus (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmSetActiveContext (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmTranslateMessage (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmLoadLayout (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmProcessKey (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmPutImeMenuItemsIntoMappedFile (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmGetProperty (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmEnumInputContext (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ImmSystemHandler (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CtfImmTIMActivate (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CtfImmRestoreToolbarWnd (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CtfImmHideToolbarWnd (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CtfImmDispatchDefImeMessage (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CtfImmNotify (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CtfImmSetDefaultRemoteKeyboardLayout (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CtfImmGetCompatibleKeyboardLayout (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter LpkTabbedTextOut (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter LpkPSMTextOut (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter LpkDrawTextEx (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter TraceRegisterExA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter TracePrintfExA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter OpenSCManagerA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00004340)2b:Td3f,"System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\Sy" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004340.00000001.293100.026D0000.00000004.mdmp2c:Tbc8,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:ffffffffc0000135] "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:ffffffffc0000135] "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:ffffffffc0000135] "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:ffffffffc0000135] "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:ffffffffc0000135] "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:ffffffffc0000135] "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:ffffffffc0000135] "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:ffffffffc0000135] "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135]2d:T2506,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "GDI32.DLL" at base 76650000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77720000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74de0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "KERNEL32" at base 767a0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "ADVAPI32.DLL" at base 765a0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 74130000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "SHLWAPI.DLL" at base 76280000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "VERSION.DLL" at base 74e60000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72cb0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "USER32.DLL" at base 763d0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "MSCOREE.DLL" at base 742b0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "PSAPI.DLL" at base 764d0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "RPCRT4.DLL" at base 75f50000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "KERNEL32.DLL" at base 767a0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 718a0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "OLE32.DLL" at base 75de0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "CRYPTBASE.DLL" at base 75410000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74100000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 73b80000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70e40000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70620000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NET.HTTP\C1F72F0CA85CB675A88EFE8F2067F7C8\SYSTEM.NET.HTTP.NI.DLL" at base 73af0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 739e0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6fea0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 740e0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "NTDLL.DLL" at base 77b80000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "SHELL32.DLL" at base 76ab0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 769f0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "PROFAPI.DLL" at base 764e0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "BCRYPT.DLL" at base 740c0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "CRYPTSP.DLL" at base 740a0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73e90000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "IPHLPAPI.DLL" at base 748c0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "DNSAPI.DLL" at base 74630000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "DHCPCSVC6.DLL" at base 743a0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "DHCPCSVC.DLL" at base 74380000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "RASAPI32.DLL" at base 73d70000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "RTUTILS.DLL" at base 74090000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 769f0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 769f0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "WS2_32.DLL" at base 76390000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74340000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74330000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 739d0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "RASMAN.DLL" at base 73d50000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "WINHTTP.DLL" at base 73970000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "SSPICLI.DLL" at base 75420000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "CREDSSP.DLL" at base 73910000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "NSI.DLL" at base 760d0000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "CFGMGR32.DLL" at base 76500000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "OLEAUT32.DLL" at base 76a10000 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 738000002e:T4c1,"15001600c03e2774fcf24b0018542574@ADVAPI32.dll" "0e000f00703f2774fcf24b0018542574@ADVAPI32.dll" "0e000f00cc3f2774fcf24b0018542574@ADVAPI32.dll" "11001200b4472774fcf24b0018542574@ADVAPI32.dll" "1100120048482774fcf24b0018542574@ADVAPI32.dll" "120013008c482774fcf24b0018542574@ADVAPI32.dll" "12001300e4482774fcf24b0018542574@ADVAPI32.dll" "14001500386e2774fcf24b0018542574@ADVAPI32.dll" "14001500506e2774fcf24b0018542574@ADVAPI32.dll" "14001500686e2774fcf24b0018542574@ADVAPI32.dll" "17001800806e2774fcf24b0018542574@ADVAPI32.dll" "0d000e00986e2774fcf24b0018542574@ADVAPI32.dll" "11001200a86e2774fcf24b0018542574@ADVAPI32.dll" "11001200bc6e2774fcf24b0018542574@ADVAPI32.dll" "0f001000fc6f2774fcf24b0018542574@ADVAPI32.dll" "140015003c702774fcf24b0018542574@ADVAPI32.dll" "1400150054702774fcf24b0018542574@ADVAPI32.dll" "0c000d009c702774fcf24b0018542574@ADVAPI32.dll" "0c000d00ac702774fcf24b0018542574@ADVAPI32.dll" "0e000f00bc702774fcf24b0018542574@ADVAPI32.dll" "0e000f00cc702774fcf24b0018542574@ADVAPI32.dll" "0b000c00dc702774fcf24b0018542574@ADVAPI32.dll" "1800190014732774fcf24b0018542574@RPCRT4.dll" "1300140040732774fcf24b0018542574@RPCRT4.dll" "1400150054732774fcf24b0018542574@RPCRT4.dll"2f:T4c1,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"30:Tfae,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004340-00000C2B-1660244154] Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00004340-00000C60-3574834685] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004340-00000C28-3575975919] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004340-00000C28-3577765264] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004340-00000C28-3577920780] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004340-00000C28-3578287517] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004340-00000C28-3578631175] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004340-00000C28-3578786156] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004340-00000C28-3578855862] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004340-00000C28-3578924240] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Net.Http\c1f72f0ca85cb675a88efe8f2067f7c8\System.Net.Http.ni.dll" [Source: 00000000-00004340-00000C28-3578975006] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00004340-00000C28-3579037099] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004340-00000C28-3579186321] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00004340-00000C28-3579234255] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004340-00000C28-3579559109] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00004340-00000C28-3580156485] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004340-00000C28-3580600970] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" [Source: 00000000-00004340-00000C28-3580867206] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00004340-00000C28-3581025688] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" [Source: 00000000-00004340-00000C28-3583007099] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00004340-00000C28-3584387916] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004340-00000C28-3584823524] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004340-00000C28-3584898653] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00004340-00000C28-3584990045] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" [Source: 00000000-00004340-00000C28-3585197877]31:Ta71,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\PENDINGDELETE"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\SETTINGS\LANGUAGECONFIGURATION"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\OLE"; Key: ""; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: ""; Value: "")32:Tf69,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXIMUMALLOWEDALLOCATIONSIZE"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "SEARCHLIST"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPV6DOMAIN"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPNAMESERVER"; Value: "")33:T60d,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.net.http\c1f72f0ca85cb675a88efe8f2067f7c8\system.net.http.ni.dll.aux" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"34:T8b7,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\SYSTEM32\wow64.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\SYSTEM32\wow64win.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\SYSTEM32\wow64cpu.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\system32\wow64log.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\FLTLIB.DLL" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\SysWOW64\FLTLIB.DLL" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.DLL" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\SysWOW64\IMM32.DLL" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll"35:T8df,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\system32\wow64log.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\FLTLIB.DLL" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-2.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-0.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-quirks-l1-1-0.dll"36:T5ff,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe.config" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\PO-UTE-MX-8d8cc7796#\" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.INI" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{B48D99DE-EE18-4C75-A7D4-9D6EB0F73391}" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb" "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" trying to access non-existent file "C:\Windows\mscorlib.pdb"37:T1be8,Pattern match: "birthpopuptypesapplyimagebeinguppernoteseveryshowsmeansextramatchtrackknownearlybegansuperpapernorthlearngivennamedendedtermspartsgroupbrandusingwomanfalsereadyaudiotakeswhile.com/livedcasesdailychildgreatjudgethoseunitsneverbroadcoastcoverapplefilescycles" Pattern match: "thing.org/multiheardpowerstandtokensolid" Pattern match: "genretrucklooksvalueframe.net/--" Pattern match: "tos.org/ladvisedpenaltysimple:if" Pattern match: "http://mathematicsmargin-top:eventually" Pattern match: "http://descriptionrelatively" Pattern match: "http://applicationslink" Pattern match: "http://navigation" Pattern match: "http://px" Pattern match: "www.world" Pattern match: "http://www.years" Pattern match: "http://interested" Pattern match: "http://familiar" Pattern match: "https://was" Pattern match: "https://ain" Pattern match: "http://whether" Pattern match: "http://interpreted" Pattern match: "http://addeventlistenerresponsible" Pattern match: "http://.jpg|right|thumb|.js" Pattern match: "http://html4/loose.dtd" Pattern match: "http://an" Pattern match: "w3.org/1999/xhtml" Pattern match: "http://imenglish" Pattern match: "http://www" Pattern match: "http://iparticipation" Pattern match: "http://.css" Pattern match: "http://ator" Pattern match: "http://www-//w3c//dtd" Pattern match: "https://www.new.eventawardsrussia.com/wp-includes/xelqofwyqgn.pdf" Pattern match: "u0000.com/\u0000" Pattern match: "w.new.eventawardsrussia.com/wp-includes/xelqofwyqgn.pdf" Pattern match: "microsoft.net/framework/v4.0.30319/" Pattern match: "www.new.eventawardsrussia.com/wp-includes/xelqofwyqgn.pdf" Pattern match: "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" Pattern match: "www.googleorganizationautocompleterequirementsconservative" Pattern match: "http://according" Pattern match: "http://www.interpretation" Pattern match: "http://s;text-align:centerfont-weight" Pattern match: "http://style=float:left;concerned" Pattern match: "http://www.wencodeuricomponent" Pattern match: "http://encoding=utf-8" Pattern match: "http://www.icon" Pattern match: "http://www.hortcut" Pattern match: "http://xt/css" Pattern match: "http://www.text-decoration:underthe" Pattern match: "http://option" Pattern match: "http://www.css" Pattern match: "http://www.c//dtd" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Heuristic match: "/.net/netclasses/httpwebrequest/connect__group$$/" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role"38:Teac,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00004340) "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004340)39:T1162,Found string "CryptoStream" (Indicator: "cryptostream"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "FromBase64String" (Indicator: "base64"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "jovendichaestantalessalirsuelopesosfinesllamabusco" (Indicator: "aes"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "cuandoenviarmadridbuscariniciotiempoporquecuentaestadopuedenjuegoscontraest" (Indicator: "aes"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "alatinafuerzaestiloguerraentrar" (Indicator: "aes"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "deutscheuropeueuskaragaeilgesvenskaespa" (Indicator: "aes"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "digoportadaespaciofamiliaantoniopermiteguardaralgunaspreciosalguiensentidovisitast" (Indicator: "aes"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "ltimaestamosoficialtambienning" (Indicator: "aes"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "ncompletaestudiosp" (Indicator: "aes"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "aescribirmedicinalicenciaconsultaaspectoscr" (Indicator: "aes"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "aespecialesdisponibleactualidadreferenciavalladolidbibliotecarelacionescalendariopol" (Indicator: "aes"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "ption="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00004340.00000000.292718.008C0000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004340.00000001.293100.008C0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004340.00000001.293100.008C0000.00000004.mdmp, 00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found string "jovendichaestantalessalirsuelopesosfinesllamabusco" (Indicator: "aes"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp")3a:T740,file/memory contains long string with (Indicator: "secret"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") file/memory contains long string with (Indicator: "password"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") Found string "stratesecretar" (Indicator: "secret"; File: "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe") file/memory contains long string with (Indicator: "secret"; File: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") file/memory contains long string with (Indicator: "password"; File: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") file/memory contains long string with (Indicator: "secret"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found string "stratesecretar" (Indicator: "secret"; Source: "00000000-00004340.00000001.293100.00AC2000.00000020.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00004340.00000001.293100.026D0000.00000004.mdmp")3b:T1006,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "SEARCHLIST"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPV6DOMAIN"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPNAMESERVER"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")3c:Ta0d,"ecompress failed with error code:" is a hint for the obfuscator "MPRESS" "ompression failed for unspecified reason" is a hint for the obfuscator "MPRESS" "etQuality is only valid for compress" is a hint for the obfuscator "MPRESS" "etWindow is only valid for compress" is a hint for the obfuscator "MPRESS" "ead is only supported in Decompress mode" is a hint for the obfuscator "MPRESS" "ecompression failed with error code:" is a hint for the obfuscator "MPRESS" "ompression failed" is a hint for the obfuscator "MPRESS" "rite is only supported in Compress mode" is a hint for the obfuscator "MPRESS" "_FieldCompressor" is a hint for the obfuscator "MPRESS" "requesterCompressors" is a hint for the obfuscator "MPRESS" "FetchGlobalCompressor" is a hint for the obfuscator "MPRESS" "RequestControllableCompressor" is a hint for the obfuscator "MPRESS" "RequestCombinedCompressor" is a hint for the obfuscator "MPRESS" "_StubCompressor" is a hint for the obfuscator "MPRESS" "StoreVisualCompressor" is a hint for the obfuscator "MPRESS" "RetrieveDividedCompressor" is a hint for the obfuscator "MPRESS" "IncludeCompressor" is a hint for the obfuscator "MPRESS" "CompressConfig" is a hint for the obfuscator "MPRESS" "OpenSeparatedCompressor" is a hint for the obfuscator "MPRESS" "DecompressArgument" is a hint for the obfuscator "MPRESS" "RetrieveHiddenCompressor" is a hint for the obfuscator "MPRESS" "CompressionMode" is a hint for the obfuscator "MPRESS" "System.IO.Compression" is a hint for the obfuscator "MPRESS" "CacheConvertibleCompressor" is a hint for the obfuscator "MPRESS" "Copyright javascriptconditionseverything

" is a hint for the obfuscator "MPRESS"3d:T1cab,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::SetupConsumer(PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/RequesterListener*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/WorkerParser*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject) at c4d834819273c01a996610613cb02a38-600009c-StatelessRequester~FetchIterableExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchAdjustableListener(System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/TransformableGenerator,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ExpandableWorker*,System.Boolean) at c4d834819273c01a996610613cb02a38-600027a-StatelessRequesterSeparatedGenerator~ReplaceExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/GeneratorCommand::CreateSegmentedListener(PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/GeneratorCommand*,System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject) at c4d834819273c01a996610613cb02a38-60001a6-StatelessRequesterRegEvaluator~SaveGroupedTransformer PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::RequestConfigurableRecommender(PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ModularStub*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/GeneratorListener*) at c4d834819273c01a996610613cb02a38-6000090-StatelessRequester~QueryActiveAuthenticator PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchAdjustableListener(System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/TransformableGenerator,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ExpandableWorker*,System.Boolean) at c4d834819273c01a996610613cb02a38-6000258-StatelessRequesterWriterExtractor~ReplaceExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchAdjustableListener(System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/TransformableGenerator,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ExpandableWorker*,System.Boolean) at c4d834819273c01a996610613cb02a38-6000214-StatelessRequesterSequentialGenerator~ReplaceExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchAdjustableListener(System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/TransformableGenerator,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ExpandableWorker*,System.Boolean) at c4d834819273c01a996610613cb02a38-600022a-StatelessRequesterDetachedReg~ReplaceExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchAdjustableListener(System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/TransformableGenerator,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ExpandableWorker*,System.Boolean) at c4d834819273c01a996610613cb02a38-6000240-StatelessRequesterLiteralGenerator~ReplaceExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchAdjustableListener(System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/TransformableGenerator,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ExpandableWorker*,System.Boolean) at c4d834819273c01a996610613cb02a38-600026a-StatelessRequesterRequesterExtractor~ReplaceExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchAdjustableListener(System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/TransformableGenerator,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ExpandableWorker*,System.Boolean) at c4d834819273c01a996610613cb02a38-600029a-StatelessRequesterConnectionRecord~ReplaceExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::QueryActiveAuthenticator(PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,System.Int32*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/RequesterListener*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ModularStub*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/RequesterMember*) at c4d834819273c01a996610613cb02a38-6000096-StatelessRequester~ScanToken PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/GeneratorCommand::CreateSegmentedListener(PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/GeneratorCommand*,System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject) at c4d834819273c01a996610613cb02a38-60001a7-StatelessRequesterRegEvaluator~DefineEngine PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchGlobalCompressor(PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/RequesterListener*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject) at c4d834819273c01a996610613cb02a38-6000094-StatelessRequester~SortMatcher PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::QueryActiveAuthenticator(PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,System.Int32*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/RequesterListener*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ModularStub*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/RequesterMember*) at c4d834819273c01a996610613cb02a38-600009b-StatelessRequester~PauseContext3e:T1d6f,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::SetupConsumer(PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/RequesterListener*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/WorkerParser*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject) at c4d834819273c01a996610613cb02a38-600009c-StatelessRequester~FetchIterableExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchAdjustableListener(System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/TransformableGenerator,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ExpandableWorker*,System.Boolean) at c4d834819273c01a996610613cb02a38-600027a-StatelessRequesterSeparatedGenerator~ReplaceExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/GeneratorCommand::CreateSegmentedListener(PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/GeneratorCommand*,System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject) at c4d834819273c01a996610613cb02a38-60001a6-StatelessRequesterRegEvaluator~SaveGroupedTransformer PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::RequestConfigurableRecommender(PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ModularStub*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/GeneratorListener*) at c4d834819273c01a996610613cb02a38-6000090-StatelessRequester~QueryActiveAuthenticator PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchAdjustableListener(System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/TransformableGenerator,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ExpandableWorker*,System.Boolean) at c4d834819273c01a996610613cb02a38-6000258-StatelessRequesterWriterExtractor~ReplaceExtractor System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[]) at c4d834819273c01a996610613cb02a38-600000f-ManagerWorker~PopWorker PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchAdjustableListener(System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/TransformableGenerator,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ExpandableWorker*,System.Boolean) at c4d834819273c01a996610613cb02a38-6000214-StatelessRequesterSequentialGenerator~ReplaceExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchAdjustableListener(System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/TransformableGenerator,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ExpandableWorker*,System.Boolean) at c4d834819273c01a996610613cb02a38-600022a-StatelessRequesterDetachedReg~ReplaceExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchAdjustableListener(System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/TransformableGenerator,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ExpandableWorker*,System.Boolean) at c4d834819273c01a996610613cb02a38-6000240-StatelessRequesterLiteralGenerator~ReplaceExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchAdjustableListener(System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/TransformableGenerator,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ExpandableWorker*,System.Boolean) at c4d834819273c01a996610613cb02a38-600026a-StatelessRequesterRequesterExtractor~ReplaceExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchAdjustableListener(System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/TransformableGenerator,System.Byte*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ExpandableWorker*,System.Boolean) at c4d834819273c01a996610613cb02a38-600029a-StatelessRequesterConnectionRecord~ReplaceExtractor PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::QueryActiveAuthenticator(PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,System.Int32*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/RequesterListener*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ModularStub*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/RequesterMember*) at c4d834819273c01a996610613cb02a38-6000096-StatelessRequester~ScanToken PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/GeneratorCommand::CreateSegmentedListener(PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/GeneratorCommand*,System.UInt16*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject) at c4d834819273c01a996610613cb02a38-60001a7-StatelessRequesterRegEvaluator~DefineEngine PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::FetchGlobalCompressor(PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/RequesterListener*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject) at c4d834819273c01a996610613cb02a38-6000094-StatelessRequester~SortMatcher PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::QueryActiveAuthenticator(PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ProfileObject,System.Int32*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/RequesterListener*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/ModularStub*,PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester/RequesterMember*) at c4d834819273c01a996610613cb02a38-600009b-StatelessRequester~PauseContext3f:T982,"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32"; Key: "ENABLEFILETRACING"; Value: "00000000") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32"; Key: "MAXFILESIZE"; Value: "00001000") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS"; Key: "ENABLEFILETRACING"; Value: "00000000") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS"; Key: "MAXFILESIZE"; Value: "00001000") "9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")40:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAJmZmZmZmZmZmZmZmZmZAACZmZmZmZmZmZmZmZmZmQAAmZmZmZmZmZmZmZmZmZkAAJmZAAAAAAAAAAAAAJmZAACZmQAAAAAAAAAAAACZmQAAmZkJmZkAAAAAAAAAmZkAAJmZmZmZkAAAAAAAAJmZAACZmZmZmZkAAAAAAACZmQAAmZmZmZmZAAAAAAAAmZkAAJmZCZmZmZAAAJmZkJmZAACZmQCZmZmZmZmZmZmZmQAAmZkAAJmZmZmZmZmZmZkAAJmZAACZmZmZmZmZmZmZAACZmQAACZmZmZmZmQCZmQAAmZkAAACZmZmZAAAAmZkAAJmZAAAAmZmZkAAAAJmZAACZmQAAAJmZmQAAAACZmQAAmZkAAACZmZkAAAAAmZkAAJmZAAAAmZmZAAAAAJmZAACZmQAAAJmZmQAAAAmZmQAAmZkAAACZmZkAAACZmZkAAJmZAAAAmZmZAAAJmZmZAACZmQAAAJmZmQAAmZmZkAAAmZkAAAAAAAAACZmZmQAAAJmZAAAAAAAAAJmZmZAAAACZmQAAAAAAAAmZmZkAAAAAmZkAAAAAAACZmZmQAAAAAJmZAAAAAAAJmZmZAAAAAACZmQAAAAAAmZmZkAAAAAAAmZmZmZmZmZmZmQAAAAAAAJmZmZmZmZmZmZAAAAAAAACZmZmZmZmZmZkAAAAAAADgAAAH4AAAB+AAAAfn///n5///5+e//+fmH//n5g//5+cH/+fnA/jn58BgZ+fgAGfn8ABn5/AB5+f4P+fn+H/n5/x/5+f4f+fn+H/n5/h/x+f4f4fn+H8H5/x+D+f//B/n//g/5//wf+f/4P/n/8H/5/+D/+AAB//gAA//4AAf/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":75,"unified_at_epoch_ms":1791107224021,"unified_at":"2026-10-04T09:47:04.021Z","metadata":{"hashes":{"sha256":"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d","sha1":"8ddbf1662cf2d2284f84104b7a15d8173afd0078","md5":"c4d834819273c01a996610613cb02a38","sha512":"b72e6763d98e69d0e4e6b9bbab423d59375a040e11891ed7290660aed662e0afc2344cb66eaba08795b1733e2d4933094d067b4b2857963be97cd3d76a784caa","ssdeep":"49152:VP4nzc040H0v2ZOnYFF4bzFDWM6TbpKVps+RDe8tAgxi+AFTnhJ00H9VdD9l6Rzi:VP4nzc040H0v2ZOnYFF4bzFDWM6TbpKx","ssdeep_chunks":["49152:VP4nzc0","49152:P4nzc04","49152:4nzc040","49152:nzc040H","49152:zc040H0","49152:c040H0v","49152:040H0v2","49152:40H0v2Z","49152:0H0v2ZO","49152:H0v2ZOn","49152:0v2ZOnY","49152:v2ZOnYF","49152:2ZOnYFF","49152:ZOnYFF4","49152:OnYFF4b","49152:nYFF4bz","49152:YFF4bzF","49152:FF4bzFD","49152:F4bzFDW","49152:4bzFDWM","49152:bzFDWM6","49152:zFDWM6T","49152:FDWM6Tb","49152:DWM6Tbp","49152:WM6TbpK","49152:M6TbpKV","49152:6TbpKVp","49152:TbpKVps","49152:bpKVps+","49152:pKVps+R","49152:KVps+RD","49152:Vps+RDe","49152:ps+RDe8","49152:s+RDe8t","49152:+RDe8tA","49152:RDe8tAg","49152:De8tAgx","49152:e8tAgxi","49152:8tAgxi+","49152:tAgxi+A","49152:Agxi+AF","49152:gxi+AFT","49152:xi+AFTn","49152:i+AFTnh","49152:+AFTnhJ","49152:AFTnhJ0","49152:FTnhJ00","49152:TnhJ00H","49152:nhJ00H9","49152:hJ00H9V","49152:J00H9Vd","49152:00H9VdD","49152:0H9VdD9","49152:H9VdD9l","49152:9VdD9l6","49152:VdD9l6R","49152:dD9l6Rz","49152:D9l6Rzi","98304:VP4nzc0","98304:P4nzc04","98304:4nzc040","98304:nzc040H","98304:zc040H0","98304:c040H0v","98304:040H0v2","98304:40H0v2Z","98304:0H0v2ZO","98304:H0v2ZOn","98304:0v2ZOnY","98304:v2ZOnYF","98304:2ZOnYFF","98304:ZOnYFF4","98304:OnYFF4b","98304:nYFF4bz","98304:YFF4bzF","98304:FF4bzFD","98304:F4bzFDW","98304:4bzFDWM","98304:bzFDWM6","98304:zFDWM6T","98304:FDWM6Tb","98304:DWM6Tbp","98304:WM6TbpK","98304:M6TbpKV","98304:6TbpKVp","98304:TbpKVps","98304:bpKVps+","98304:pKVps+R","98304:KVps+RD","98304:Vps+RDe","98304:ps+RDe8","98304:s+RDe8t","98304:+RDe8tA","98304:RDe8tAg","98304:De8tAgx","98304:e8tAgxi","98304:8tAgxi+","98304:tAgxi+A","98304:Agxi+AF","98304:gxi+AFT","98304:xi+AFTn","98304:i+AFTnh","98304:+AFTnhJ","98304:AFTnhJ0","98304:FTnhJ00","98304:TnhJ00H","98304:nhJ00H9","98304:hJ00H9V","98304:J00H9Vd","98304:00H9VdD","98304:0H9VdD9","98304:H9VdD9l","98304:9VdD9l6","98304:VdD9l6R","98304:dD9l6Rz","98304:D9l6Rzi","49152:M6TbpKx"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"bounty-88197275386330222","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1641984,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1739841690000,"last_seen":1739841690000,"last_multi_scan":1739841690000}},"detections":{"summary":{"verdict":"malicious","score":75,"tags":null},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":38},"sandbox_signatures":{"informative_count":86,"suspicious_count":9,"malicious_count":2,"total":97},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/MSIL.Agensla","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Wacatac_B_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/TrojanDownloader.Agent.RTP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.Wacatac.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Downldr.X.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Downloader.MSIL.PureCrypter.Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Persistence","technique":"Port Monitors","attack_id":"T1547.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/010","identifiers":[{"type":"informative","value":"Contains ability to setup port monitor (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to encrypt/decrypt data using TripleDES"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"suspicious","value":"Uses a .NET obfuscator to hide its code"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"malicious","value":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"type":"suspicious","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","identifiers":[{"type":"suspicious","value":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve operating system version"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"$25","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$26","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004340.00000001.293100.008C0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004340.00000001.293100.00AC2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/decrypt data using TripleDES","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\")\n Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00004340.00000001.293100.00AC2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-486","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"ses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004340.00000000.292718.008C0000.00000004.mdmp\"), Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004340.00000001.293100.026D0000.00000004.mdmp\"), Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004340.00000001.293100.026D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.TripleDESCryptoServiceProvider\" and TypeReference \".ctor\" in \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004340.00000001.293100.026D0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004340.00000001.293100.026D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"] ^ a d\" (Indicator: \" ^ \"; File: \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\")\n Found string \"] ^ a d\" (Indicator: \" ^ \"; Source: \"00000000-00004340.00000001.293100.00AC2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to encrypt/decrypt data using TripleDES\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains ability to decrypt/decode data\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to perform symmetric crypto operations\n Matched sigs: Dotnet file contains encryption/decryption functions\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to perform crypto operations\n Matched sigs: Contains ability to decode string content at runtime (Dotnet)\n Matched sigs: Contains ability to perform symmetric decryption (Dotnet)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004340-00000C29-3579325508\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"sendMessageChannelCache\" (Indicator: \"sendmessage\"; Source: \"00000000-00004340.00000001.293100.026D0000.00000004.mdmp\")\n Found reference to API \"System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00004340.00000001.293100.026D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" called \"IsWow64Process\" with parameter \"4340\" - (UID: 00000000-00004340)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004340)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000b8ef8e00bcf84b00e733bb771634bb7788f94b000100000094018c00010000003cf84b00b416bc77c020c8779a16bc77cf42c67788f94b000100000001000000c8d18e00000000000cf84b003cf84b00a8f84b004558bf7723013700feffffff9a16bc77a519757500006e7600000000 (UID: 00000000-00004340)\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007750726f6365737349642c302c302c2c313066340d0a006c33322e646c6c2c223235333a30313a33382e393136222c52583d302c50583d30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004340)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00004340.00000000.292718.008C0000.00000004.mdmp\n 00000000-00004340.00000001.293100.008C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::OpenProcessor(System.UInt64) at c4d834819273c01a996610613cb02a38-60000f6-StatelessRequester~CancelCollection\n PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::OpenProcessor(System.UInt64) at c4d834819273c01a996610613cb02a38-60000f0-StatelessRequester~QueryEfficientHandler\n PO-UTE-MX-873535363839939383635.API.Requester.StatelessRequester::OpenProcessor(System.UInt64) at c4d834819273c01a996610613cb02a38-60000f7-StatelessRequester~QueryLogicalChooser","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" queries volume information of \"C:\\9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" at 00000000-00004340-00000046-4206761","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00004340)\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00004340)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"Sleep\"; File: \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\")\n Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00004340.00000001.293100.00AC2000.00000020.mdmp\")\n Found reference to API (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004340.00000001.293100.026D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessor\" (Indicator: \"OpenProcess\"; File: \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\")\n Found reference to API \"OpenProcessor\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004340.00000001.293100.00AC2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"RasPbFile\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2c","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"file/memory contains long string with (Indicator: \"twitter\"; File: \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\")\n file/memory contains long string with (Indicator: \"twitter\"; File: \"00000000-00004340.00000001.293100.00AC2000.00000020.mdmp\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 718A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 740C0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 73460000\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72CB0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75F50000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" was detected as \".NET\" and name: \"Library\"\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2f","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x18f200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x18f144\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; File: \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\")\n Found string \"http-equiv=\"Content-Typeding=\"0\" cellspacing=\"0\"html; charset=utf-8\" /> style=\"display:none;\"><

\" (Indicator: \"text/javascript\"; File: \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\"), file/memory contains long string with (Indicator: \"text/javascript\"; File: \"00000000-00004340.00000001.293100.00AC2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to setup port monitor (API string)","description":"Found reference to API \"AddMonitor\" (Indicator: \"AddMonitor\"; File: \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\")\n Found reference to API \"AddMonitor\" (Indicator: \"AddMonitor\"; Source: \"00000000-00004340.00000001.293100.00AC2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.010","relevance":1,"id":"string-421","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004340)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Tries to sleep for a long time (more than two minutes)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" touched file \"C:\\Windows\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.pdb\"\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" touched file \"C:\\Windows\\mscorlib.pdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004340-00000C29-3581154526\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00004340-00000C29-3583263725\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00004340-00000C29-3583264180\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.Http\" in \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n Potential IP \"4.5.9.0\" found in string \"ersion=4.5.9.0, Culture=neutral, PublicKeyToken=\"\n Potential IP \"4.0.0.0\" found in string \"ersion=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\"/>\", Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0\n Culture=\", Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0\n C\", Potential IP \"4.0.0.0\" found in string \"4.0.0.0\n Cul\", Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0\n Culture=ne\", \"2.5.29.10\", \"2.5.29.19\", \"2.5.29.14\", \"2.5.29.15\", \"2.5.29.37\", \"192.168.0.1\", \"255.255.255.255\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$37","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.world\"\n Found HTTPS url \"https://was\"\n Found HTTPS url \"https://ain\"\n Found HTTPS url \"https://www.recent\"\n Found HTTPS url \"https://www.new.eventawardsrussia.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004340)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00004340.00000000.292718.008C0000.00000004.mdmp, 00000000-00004340.00000001.293100.008C0000.00000004.mdmp\")\n Found string \"stem32\\drivers\\NetMon64.sys\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00004340.00000000.292718.012D0000.00000002.mdmp\")\n Found string \"o C:\\Windows\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004340.00000000.292718.012D0000.00000002.mdmp\")\n Found string \"m32\\drivers\\SandboxFltr.sys\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00004340.00000000.292718.012D0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004340.00000001.293100.026D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" at 00000000-00004340-00000033-5404410","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 4340)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe queries ProcessDebugPort (UID: 4340)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses a .NET obfuscator to hide its code","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1140","relevance":2,"id":"string-6","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"$3d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$3e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"Sleep\" (Source: 9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":64,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"67b3e09ae3e5058bb90856b3","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":75,"submit_name":"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe","analysis_start_time":"2025-02-18T01:21:31+00:00","indicators_count":{"informative":86,"suspicious":14,"malicious":2},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}],"processes":[{"pid":4340,"ppid":0,"name":"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe","command_line":"","sha256":"9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d","normalized_path":"C:\\9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d.exe","uid":"00000000-00004340","icon":"$40"}],"all_imported_dlls":["vcruntime140_clr0400.dll","System.Core.ni.dll","System.Xml.ni.dll","dhcpcsvc.dll","rasman.dll","msctf.dll","cfgmgr32.dll","fltLib.dll","mscoree.dll","sechost.dll","VxSSL32.dll","ole32.dll","winnsi.dll","WSHTCPIP.DLL","winhttp.dll","wow64win.dll","user32.dll","nlssorting.dll","IPHLPAPI.DLL","credssp.dll","ucrtbase_clr0400.dll","System.Configuration.ni.dll","dnsapi.dll","webio.dll","mscorrc.dll","cryptbase.dll","cryptsp.dll","psapi.dll","KernelBase.dll","msvcrt.dll","oleaut32.dll","imm32.dll","api-ms-win-core-xstate-l2-1-0.dll","rsaenh.dll","rasapi32.dll","sspicli.dll","ntdll.dll","lpk.dll","usp10.dll","shlwapi.dll","System.ni.dll","kernel32.dll","mswsock.dll","wow64cpu.dll","advapi32.dll","version.dll","clrjit.dll","shell32.dll","dhcpcsvc6.dll","wship6.dll","nsi.dll","mscoreei.dll","profapi.dll","wow64.dll","rpcrt4.dll","ws2_32.dll","gdi32.dll","System.Net.Http.ni.dll","bcrypt.dll","rtutils.dll","mscorlib.ni.dll","diasymreader.dll","api-ms-win-core-synch-l1-2-0.dll","clr.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{B48D99DE-EE18-4C75-A7D4-9D6EB0F73391}","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"67b3e09ae3e5058bb90856b3"}]}]}},"report_ids":{"sandbox_job_ids":["67b3e09ae3e5058bb90856b3"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 9bf21ab8b013… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9bf21ab8b013…. Malware family: Win/malicious_confidence_100%. Threat score 75/100. 10/25 AV engines flagged this file. 2 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 9bf21ab8b013… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9bf21ab8b013…. Malware family: Win/malicious_confidence_100%. Threat score 75/100. 10/25 AV engines flagged this file. 2 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9bf21ab8b013ba06fcf025838cd0ac89278f7757d04c8713f3ca4223d75cbd3d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 9bf21ab8b013… — Score 75/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9bf21ab8b013…. Malware family: Win/malicious_confidence_100%. Threat score 75/100. 10/25 AV engines flagged this file. 2 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L41","11",{}]]