26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 43:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ba,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.MSIL.Quasar Sample 9d16ec73785c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9d16ec73785c…. Malware family: Trojan.MSIL.Quasar. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3","keywords":["Malicious","Trojan.MSIL.Quasar","malware analysis","sandbox report","threat intelligence","9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3"],"about":{"@type":"SoftwareApplication","name":"a9db2789f14e86e7d66d97ce42bb3d79.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.MSIL.Quasar","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Te1f,Found reference to "PbeSha1_RC2_40" (Indicator: "RC2"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "RC2_CBC_40" (Indicator: "RC2"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "SRTP_NULL_HMAC_SHA1_80" (Indicator: "HMAC"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "HMAC"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "HMAC_SHA1" (Indicator: "HMAC"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "EncryptionECDsaWithSha1" (Indicator: "ECDsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "TRAILER_SHA512" (Indicator: "SHA512"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "ecka_eg_X963kdf_SHA512" (Indicator: "SHA512"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "sphincs256_with_SHA512" (Indicator: "SHA512"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "xmss_with_SHA512" (Indicator: "SHA512"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "xmss_mt_with_SHA512" (Indicator: "SHA512"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "ecdsa_plain_SHA512" (Indicator: "SHA512"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "EncryptionECDsaWithSha512" (Indicator: "ECDsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "SRTP_NULL_HMAC_SHA1_32" (Indicator: "HMAC"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "HMAC"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "Aes192" (Indicator: "Aes"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "ECDsaWithSha2" (Indicator: "ECDsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "TRAILER_SHA512_224" (Indicator: "SHA512"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "EncryptionECDsaWithSha224" (Indicator: "ECDsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "RC2_64" (Indicator: "RC2"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found reference to "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin")28:T10cf,Found string "[PRIVATE KEY LOCATION: "{0}"]" (Indicator: "private key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Private key passed - public key expected." (Indicator: "private key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Private key passed - public key expected." (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Public Key:" (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Public key presented not for certificate signature" (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Public key certificate for attribute certificate cannot be searched." (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Subject public key cannot be decoded." (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Public key of issuer certificate of CRL could not be retrieved." (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Attribute certificate issuer is also a public key certificate issuer." (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Public key certificate specified in base certificate ID for attribute certificate cannot be found." (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Certification path for public key certificate of attribute certificate could not be build." (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Trusted CA Public Key:" (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "expected public key" (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Unrecognized curve OID for GostR3410x2001 private key" (Indicator: "private key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "algorithm identifier in private key not recognised" (Indicator: "private key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "error recovering GOST3410_2001 public key" (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "invalid length for GOST3410_2001 public key" (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "error recovering GOST3410_94 public key" (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "error recovering GOST3410_2012 public key" (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "invalid length for GOST3410_2012 public key" (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "algorithm identifier in public key not recognised:" (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Expected a public key" (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Expected a private key" (Indicator: "private key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "invalid DH public key" (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "OID is not a valid public key parameter set" (Indicator: "public key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "EOF encountered in middle of Ed25519 private key" (Indicator: "private key"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin")29:T7be,".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003452) ".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003452) ".exe" called "RtlGetVersion" (UID: 00000000-00003452) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000740169000000000005000000002a00005001690019000000d00d6d0000000000190000001cf61f0014000000acf71f0095e1d577b1962800feffffff000000000200000250a36c00aa0400ae10000000e4f71f00000000008000000030f71f00432a006980e46c0001000000d00d6d00020000000c000000d89f6c00d89f6c00d39f6c00000000000c6cd70000006900000000019cf61f006435d76dbcfc1f0095e1d57791962800feffffff435cd9775059d97794000000a0000000d29f6c00d09f6c009400000040f81f00fdfe2b77c408000010000000e8f71f0001000000 (UID: 00000000-00003452)2a:T4f5,Found string "SELECT * FROM Win32_BIOS" (Indicator: "select * from "; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: "select * from "; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Select * From Win32_ComputerSystem" (Indicator: "select * from "; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SELECT * FROM Win32_DisplayConfiguration" (Indicator: "select * from "; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: "select * from "; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SELECT * FROM AntivirusProduct" (Indicator: "select * from "; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SELECT * FROM FirewallProduct" (Indicator: "select * from "; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin")2b:T16a2,".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003452) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003452)2c:T464e,".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003452) ".exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003452)2d:T418,"SELECT Caption FROM Win32_OperatingSystem" (Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin, Indicator: "select caption from win32_operatingsystem") "SELECT * FROM Win32_BIOS" (Source: 6000239-_~_, Indicator: "select * from win32_bios") "SELECT * FROM Win32_BaseBoard" (Source: 600023a-_~_, Indicator: "select * from win32_baseboard") "SELECT * FROM Win32_Processor" (Source: 600023b-_~_, Indicator: "select * from win32_processor") "Select * From Win32_ComputerSystem" (Source: 600023c-_~_, Indicator: "select * from win32_computersystem") "SELECT * FROM Win32_DisplayConfiguration" (Source: 600023d-_~_, Indicator: "select * from win32_displayconfiguration") "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Source: 6000269-_~_, Indicator: "select * from win32_operatingsystem where primary='true'") "SELECT * FROM AntivirusProduct" (Source: 600026b-_~_, Indicator: "select * from antivirusproduct") "SELECT * FROM FirewallProduct" (Source: 600026c-_~_, Indicator: "select * from firewallproduct")2e:T19be,"Software\Microsoft\Windows\CurrentVersion\Run" in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions" in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "BraveSoftware\Brave-Browser\User Data\Local State" in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Software\Microsoft\Internet Explorer\IntelliForms\Storage2" in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Opera Software\Opera GX Stable\Login Data" in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Opera Software\Opera GX Stable\Local State" in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Opera Software\Opera Stable\Login Data" in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Opera Software\Opera Stable\Local State" in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Software\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 6000042-_~_ "SOFTWARE\\\\Martin Prikryl\\\\WinSCP 2\\\\Sessions" in Source: 600007f-_~ReadAccounts "BraveSoftware\\Brave-Browser\\User Data\\Default\\Login Data" in Source: 6000087-_~ReadAccounts "BraveSoftware\\Brave-Browser\\User Data\\Local State" in Source: 6000087-_~ReadAccounts "Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2" in Source: 60000d7-_~_ "Opera Software\\Opera GX Stable\\Login Data" in Source: 600011c-_~ReadAccounts "Opera Software\\Opera GX Stable\\Local State" in Source: 600011c-_~ReadAccounts "Opera Software\\Opera Stable\\Login Data" in Source: 600011f-_~ReadAccounts "Opera Software\\Opera Stable\\Local State" in Source: 600011f-_~ReadAccounts "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 60001c8-_~_ "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce" in Source: 60001c8-_~_ "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 60001c8-_~_ "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce" in Source: 60001c8-_~_ "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003452.00000000.67512.00660000.00000004.mdmp 00000000-00003452.00000001.69432.00660000.00000004.mdmp 00000000-00003452.00000002.71352.00660000.00000004.mdmp 00000000-00003452.00000003.76898.00660000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00003452.00000000.67512.00660000.00000004.mdmp 00000000-00003452.00000001.69432.00660000.00000004.mdmp 00000000-00003452.00000002.71352.00660000.00000004.mdmp 00000000-00003452.00000003.76898.00660000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\S" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00003452.00000000.67512.01C40000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003452.00000000.67512.7F6F0000.00000002.mdmp 00000000-00003452.00000001.69432.7F6F0000.00000002.mdmp 00000000-00003452.00000002.71352.7F6F0000.00000002.mdmp 00000000-00003452.00000003.76898.7F6F0000.00000002.mdmp2f:T601,".exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]30:T11bd,".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 ".exe" loaded module "KERNEL32" at base 77270000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 ".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 72820000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 69150000 ".exe" loaded module "USER32.DLL" at base 77c70000 ".exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 ".exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 ".exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 ".exe" loaded module "MSCOREE.DLL" at base 73420000 ".exe" loaded module "RPCRT4.DLL" at base 77bc0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 ".exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74720000 ".exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6da90000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 65990000 ".exe" loaded module "NTDLL.DLL" at base 77d40000 ".exe" loaded module "BCRYPT.DLL" at base 75760000 ".exe" loaded module "CRYPTBASE.DLL" at base 75b40000 ".exe" loaded module "PSAPI.DLL" at base 77590000 ".exe" loaded module "UXTHEME.DLL" at base 74720000 ".exe" loaded module "COMCTL32.DLL" at base 74ac0000 ".exe" loaded module "GDI32.DLL" at base 77eb0000 ".exe" loaded module "ADVAPI32.DLL" at base 777c0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6d980000 ".exe" loaded module "SHLWAPI.DLL" at base 77210000 ".exe" loaded module "VERSION.DLL" at base 751c0000 ".exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 ".exe" loaded module "KERNEL32.DLL" at base 77270000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 67d40000 ".exe" loaded module "OLE32.DLL" at base 773a0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6d840000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 672e0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 67130000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 662c0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d7c0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 65aa0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 65210000 ".exe" loaded module "SHELL32.DLL" at base 76520000 ".exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 760c0000 ".exe" loaded module "PROFAPI.DLL" at base 75c60000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 ".exe" loaded module "CRYPTSP.DLL" at base 75650000 ".exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 753e0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 ".exe" loaded module "DWMAPI.DLL" at base 744f0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 031:T418,"SELECT Caption FROM Win32_OperatingSystem" (Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin, Indicator: "select caption from win32_operatingsystem") "SELECT * FROM Win32_BIOS" (Source: 6000239-_~_, Indicator: "select * from win32_bios") "SELECT * FROM Win32_BaseBoard" (Source: 600023a-_~_, Indicator: "select * from win32_baseboard") "SELECT * FROM Win32_Processor" (Source: 600023b-_~_, Indicator: "select * from win32_processor") "Select * From Win32_ComputerSystem" (Source: 600023c-_~_, Indicator: "select * from win32_computersystem") "SELECT * FROM Win32_DisplayConfiguration" (Source: 600023d-_~_, Indicator: "select * from win32_displayconfiguration") "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Source: 6000269-_~_, Indicator: "select * from win32_operatingsystem where primary='true'") "SELECT * FROM AntivirusProduct" (Source: 600026b-_~_, Indicator: "select * from antivirusproduct") "SELECT * FROM FirewallProduct" (Source: 600026c-_~_, Indicator: "select * from firewallproduct")32:T15d1,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003452-00000C24-18051068] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003452-00000C24-18424706] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003452-00000C24-18499674] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003452-00000C24-18996948] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003452-00000C24-34977637] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003452-00000C24-35746834] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003452-00000C24-35942265] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003452-00000C24-36214157] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003452-00000C24-36375708] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00003452-00000C24-36434245] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00003452-00000C24-36492515] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003452-00000C24-36748130] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003452-00000C24-36818026] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003452-00000C24-36919939] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003452-00000C24-37151158] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003452-00000C24-37672587] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00003452-00000C24-37838631] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003452-00000C24-38255152] Observed system executable string:"C:\Windows\Temp\VxOle32.dll" [Source: 00000000-00003452.00000000.67512.00010000.00000040.mdmp 00000000-00003452.00000000.67512.000F0000.00000002.mdmp 00000000-00003452.00000001.69432.00010000.00000040.mdmp 00000000-00003452.00000001.69432.000F0000.00000002.mdmp 00000000-00003452.00000002.71352.00010000.00000040.mdmp 00000000-00003452.00000002.71352.000F0000.00000002.mdmp 00000000-00003452.00000003.76898.00010000.00000040.mdmp 00000000-00003452.00000003.76898.000F0000.00000002.mdmp] Observed system executable string:"C:\Windows\Temp\VxSSL32.dll" [Source: 00000000-00003452.00000000.67512.00020000.00000040.mdmp 00000000-00003452.00000000.67512.00220000.00000002.mdmp 00000000-00003452.00000001.69432.00020000.00000040.mdmp 00000000-00003452.00000001.69432.00220000.00000002.mdmp 00000000-00003452.00000002.71352.00020000.00000040.mdmp 00000000-00003452.00000002.71352.00220000.00000002.mdmp 00000000-00003452.00000003.76898.00020000.00000040.mdmp 00000000-00003452.00000003.76898.00220000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\sxsoa.dll" [Source: 00000000-00003452.00000000.67512.00030000.00000002.mdmp 00000000-00003452.00000001.69432.00030000.00000002.mdmp 00000000-00003452.00000002.71352.00030000.00000002.mdmp 00000000-00003452.00000003.76898.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\GdiPlus.dll" [Source: 00000000-00003452.00000000.67512.00030000.00000002.mdmp 00000000-00003452.00000001.69432.00030000.00000002.mdmp 00000000-00003452.00000002.71352.00030000.00000002.mdmp 00000000-00003452.00000003.76898.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\comctl32.dll" [Source: 00000000-00003452.00000000.67512.00030000.00000002.mdmp 00000000-00003452.00000001.69432.00030000.00000002.mdmp 00000000-00003452.00000002.71352.00030000.00000002.mdmp 00000000-00003452.00000003.76898.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\sxsoaps.dll" [Source: 00000000-00003452.00000000.67512.00030000.00000002.mdmp 00000000-00003452.00000001.69432.00030000.00000002.mdmp 00000000-00003452.00000002.71352.00030000.00000002.mdmp 00000000-00003452.00000003.76898.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\comctl32.dll.mui" [Source: 00000000-00003452.00000000.67512.00030000.00000002.mdmp 00000000-00003452.00000001.69432.00030000.00000002.mdmp 00000000-00003452.00000002.71352.00030000.00000002.mdmp 00000000-00003452.00000003.76898.00030000.00000002.mdmp]33:T712,".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\V4.0"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\STANDARDS\V4.0.30319"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: ""; Value: "")34:Tbfd,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "319DC449-ADA5-50F7-428E-957DB6791668"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\NET FRAMEWORK SETUP\NDP\V4\FULL"; Key: "RELEASE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "9D16EC73785C06EE7ECCD44C6D8694FFAEC537BE881AC4226BC2095DB312AEA3"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "DISABLECONFIGCACHE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "763FD754-7086-4DFE-95EB-C01A46FAF4CA"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A669021C-C450-4609-A035-5AF59AF4DF18"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "CC2BCBBA-16B6-4CF3-8990-D74C2E8AF500"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "CACHELOCATION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "DOWNLOADCACHEQUOTAINKB"; Value: "")35:T47b,".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" ".exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" ".exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"36:T6d2,".exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" ".exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" trying to touch file "C:\9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.exe.config" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to touch file "C:\Windows\system32\VERSION.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to touch file "C:\Windows\system32\ucrtbase_clr0400.dll"37:T961,".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\system32\combase.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" ".exe" trying to access non-existent file "C:\CRYPTSP.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" ".exe" trying to access non-existent file "C:\dwmapi.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL"38:T5b0,".exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to access non-existent file "C:\9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.exe.config" ".exe" trying to access non-existent file "C:\9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.INI" ".exe" trying to access non-existent file "C:\9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.exe.Local\" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\CLIENT" ".exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" ".exe" trying to access non-existent file "C:\9D16EC73785C06EE7ECCD44C6D8694FFAEC537BE881AC4226BC2095DB312AEA3.EXE.CONFIG" ".exe" trying to access non-existent file "C:\9D16EC73785C06EE7ECCD44C6D8694FFAEC537BE881AC4226BC2095DB312AEA3.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to access non-existent file "C:\9D16EC73785C06EE7ECCD44C6D8694FFAEC537BE881AC4226BC2095DB312AEA3.EXE.LOCAL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Client\"39:T158f,Heuristic match: "Org.BouncyCastle.Asn1.UA" Heuristic match: "Org.BouncyCastle.Math.EC" Heuristic match: "Org.BouncyCastle.Crypto.EC" Heuristic match: "Org.BouncyCastle.Asn1.GM" Heuristic match: "Org.BouncyCastle.Math.EC.Custom.GM" Heuristic match: "Org.BouncyCastle.Crypto.IO" Heuristic match: "Org.BouncyCastle.Utilities.IO" Pattern match: "https://ipwho.is/" Pattern match: "https://stackoverflow.com/q/11564914/23354" Pattern match: "https://stackoverflow.com/q/14436606/23354" Pattern match: "https://api.ipify.org/" Pattern match: "https://stackoverflow.com/q/2152978/23354" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "http://schemas.microsoft.com/SMI/2016/WindowsSettings" Heuristic match: "PATHEXT=.COM;.EXE;.BAT;.CM" Heuristic match: ".Http.Tr" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "bb\System.Windows.Fo" Heuristic match: "BsT.Bs" Heuristic match: "m.runtime.re" Heuristic match: "

.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003452) ".exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00003452) ".exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003452)3b:Tf25,Found string "P~AeS" (Indicator: "aes"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "PQAeS~" (Indicator: "aes"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "mChacha20" (Indicator: "chacha"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "ecdsa_plain_RIPEMD160" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "aes"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "aes128"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "ecdsa_plain_SHA1" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "id_TA_ECDSA_SHA_1" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "EncryptionECDsaWithSha1" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "ecdsa_sha1" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "ecdsa_plain_SHA512" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "IdEcdsaWithSha3_512" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "id_TA_ECDSA_SHA_512" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "THREEFISH_512" (Indicator: "threefish"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "EncryptionECDsaWithSha512" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "ecdsa_secp521r1_sha512" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "ecdsa_brainpoolP512r1tls13_sha512" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "aes"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "aes128"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "ecka_eg_SessionKDF_AES192" (Indicator: "aes"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "ecka_eg_SessionKDF_AES192" (Indicator: "aes192"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "AES_192" (Indicator: "aes"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Aes192" (Indicator: "aes"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Aes192" (Indicator: "aes192"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "ECDsaWithSha2" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "THREEFISH_1024" (Indicator: "threefish"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "ecdsa_plain_SHA224" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "IdEcdsaWithSha3_224" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "id_TA_ECDSA_SHA_224" (Indicator: "ecdsa"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin")3c:Tee4,Found string "passwordBasedMac" (Indicator: "password"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "password_value" (Indicator: "password"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Export of key material requires extended_master_secret" (Indicator: "secret"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "no password supplied when one expected" (Indicator: "password"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "cannot export keying material without extended_master_secret" (Indicator: "secret"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "BCrypt password must be <= 72 bytes" (Indicator: "password"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Missing password." (Indicator: "password"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "extended_master_secret" (Indicator: "secret"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "password" (Indicator: "password"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "extended master secret" (Indicator: "secret"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "master secret" (Indicator: "secret"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "PKCS12 key store MAC invalid - wrong password or corrupted file." (Indicator: "password"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "password supplied for keystore that does not require one" (Indicator: "password"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "No password finder specified, but a password is required" (Indicator: "password"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Password is null, but a password is required" (Indicator: "password"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Partner MacTag validation failed. Therefore, the password, MAC, or digest algorithm of each participant does not match." (Indicator: "password"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "verification requires password check" (Indicator: "password"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "can't create secret key object:" (Indicator: "secret"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "exception decrypting secret key" (Indicator: "secret"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "secret key ring doesn't start with secret key tag: tag 0x" (Indicator: "secret"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00003452.00000000.67512.01C40000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00003452.00000000.67512.01C40000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00003452.00000000.67512.01C40000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00003452.00000000.67512.01C40000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00003452.00000000.67512.01C40000.00000004.mdmp")3d:T510,Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SELECT * FROM Win32_BIOS" (Indicator: " Win32_BIOS"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "Select * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: " Win32_OperatingSystem"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin") Found string "SELECT * FROM AntivirusProduct" (Indicator: "antivirusproduct"; File: "9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin")3e:Te87,Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009bf-EventFacade~add_MouseMove Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009bc-EventFacade~remove_KeyPress Gma.System.MouseKeyHook.Implementation.GlobalMouseListener::IsDoubleClick(Gma.System.MouseKeyHook.MouseEventExtArgs) at a9db2789f14e86e7d66d97ce42bb3d79-60009b0-GlobalMouseListener~ProcessDown Gma.System.MouseKeyHook.Implementation.BaseListener::get_Handle() at a9db2789f14e86e7d66d97ce42bb3d79-60009a6-BaseListener~Dispose Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009c5-EventFacade~add_MouseDown Gma.System.MouseKeyHook.Implementation.KeyListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at a9db2789f14e86e7d66d97ce42bb3d79-60009ac-ctor Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009d3-EventFacade~add_MouseDragStarted Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009d7-EventFacade~add_MouseDragFinished Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009bb-EventFacade~add_KeyPress Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009c4-EventFacade~remove_MouseClick Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009d2-EventFacade~remove_MouseDoubleClick Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009d4-EventFacade~remove_MouseDragStarted Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009cb-EventFacade~add_MouseUpExt Gma.System.MouseKeyHook.Implementation.BaseListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at a9db2789f14e86e7d66d97ce42bb3d79-60009f5-ctor Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009bd-EventFacade~add_KeyUp Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009d1-EventFacade~add_MouseDoubleClick Gma.System.MouseKeyHook.Implementation.EventFacade::CreateKeyListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009dc-EventFacade~GetKeyListener Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009d0-EventFacade~remove_MouseWheelExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009c7-EventFacade~add_MouseDownExt Gma.System.MouseKeyHook.Implementation.BaseListener::set_Handle(Gma.System.MouseKeyHook.WinApi.HookResult) at a9db2789f14e86e7d66d97ce42bb3d79-60009a3-ctor Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009cf-EventFacade~add_MouseWheelExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009c2-EventFacade~remove_MouseMoveExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009d8-EventFacade~remove_MouseDragFinished Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009cc-EventFacade~remove_MouseUpExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009c8-EventFacade~remove_MouseDownExt3f:Te1e,System.Type::GetProperties(System.Reflection.BindingFlags) at a9db2789f14e86e7d66d97ce42bb3d79-600057b-MapDecorator_3~GetIndexerSetter Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009bf-EventFacade~add_MouseMove Org.BouncyCastle.Crypto.Tls.TlsUtilities::IsTimeout(System.Net.Sockets.SocketException) at a9db2789f14e86e7d66d97ce42bb3d79-6002ff3-DtlsTransport~Send Org.BouncyCastle.Tls.TlsUtilities::IsTimeout(System.Net.Sockets.SocketException) at a9db2789f14e86e7d66d97ce42bb3d79-60013d2-DtlsRecordLayer~ReceiveDatagram Org.BouncyCastle.Crypto.Tls.TlsUtilities::IsTimeout(System.Net.Sockets.SocketException) at a9db2789f14e86e7d66d97ce42bb3d79-6002ff2-DtlsTransport~Receive Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009bc-EventFacade~remove_KeyPress Gma.System.MouseKeyHook.Implementation.GlobalMouseListener::IsDoubleClick(Gma.System.MouseKeyHook.MouseEventExtArgs) at a9db2789f14e86e7d66d97ce42bb3d79-60009b0-GlobalMouseListener~ProcessDown Org.BouncyCastle.Tls.OfferedPsks::get_Binders() at a9db2789f14e86e7d66d97ce42bb3d79-6001983-TlsUtilities~SelectPreSharedKey Gma.System.MouseKeyHook.Implementation.BaseListener::get_Handle() at a9db2789f14e86e7d66d97ce42bb3d79-60009a6-BaseListener~Dispose Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009c5-EventFacade~add_MouseDown Gma.System.MouseKeyHook.Implementation.KeyListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at a9db2789f14e86e7d66d97ce42bb3d79-60009ac-ctor Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009d3-EventFacade~add_MouseDragStarted Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009d7-EventFacade~add_MouseDragFinished System.Net.Sockets.Socket::Send(System.Byte[]) at a9db2789f14e86e7d66d97ce42bb3d79-6000059-_~_ Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009bb-EventFacade~add_KeyPress Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009c4-EventFacade~remove_MouseClick System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at a9db2789f14e86e7d66d97ce42bb3d79-600074b-RuntimeTypeModel~WriteGetKeyImpl Org.BouncyCastle.Tls.TlsUtilities::IsTimeout(System.Net.Sockets.SocketException) at a9db2789f14e86e7d66d97ce42bb3d79-6001417-DtlsTransport~Receive System.Type::GetMethods(System.Reflection.BindingFlags) at a9db2789f14e86e7d66d97ce42bb3d79-6000862-CompilerContext~GetWriterMethod Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009d2-EventFacade~remove_MouseDoubleClick System.Type::GetProperties(System.Reflection.BindingFlags) at a9db2789f14e86e7d66d97ce42bb3d79-60007ce-TypeModel~GetListItemType Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009d4-EventFacade~remove_MouseDragStarted Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009cb-EventFacade~add_MouseUpExt Gma.System.MouseKeyHook.Implementation.BaseListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at a9db2789f14e86e7d66d97ce42bb3d79-60009f5-ctor Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at a9db2789f14e86e7d66d97ce42bb3d79-60009bd-EventFacade~add_KeyUp40:T5f9,"2.5.29.19" "2.5.29.15" "2.5.29.37" "2.5.29.17" "2.5.29.18" "1.3.132.0" "2.5.1.1" Potential IP "2.4.8.1" found in string "2.4.8.1+cce1c58590" "2.4.0.0" "1.9.0.1" "1.4.1.0" "2.5.4.5" "2.5.4.72" "2.5.29.9" "2.5.29.14" "2.5.29.16" "2.5.29.20" "2.5.29.21" "2.5.29.23" "2.5.29.24" "2.5.29.27" "2.5.29.28" "2.5.29.29" "2.5.29.30" "2.5.29.31" "2.5.29.32" "2.5.29.33" "2.5.29.35" "2.5.29.36" "2.5.29.46" "2.5.29.54" "2.5.29.56" "2.5.29.55" "2.5.29.60" "2.5.4.6" "2.5.4.10" "2.5.4.11" "2.5.4.12" "2.5.4.3" "2.5.4.9" "2.5.4.7" "2.5.4.8" "2.5.4.4" "2.5.4.42" "2.5.4.43" "2.5.4.44" "2.5.4.45" "2.5.4.15" "2.5.4.17" "2.5.4.46" "2.5.4.65" "2.5.4.16" "2.5.4.54" "2.5.4.20" "2.5.4.41" "2.5.4.97" "1.3.36.8" "1.3.1.1" "1.2.2.1" "1.2.2.2" "1.2.2.3" "1.2.2.4" "1.2.2.5" "1.2.2.6" "1.3.36.3" Potential IP "4.0.0.0" found in string ".SqlXml,4.0.0.0,,b77a5c561934e089,MSIL" Potential IP "4.0.0.0" found in string "SeDebugPrivilegesion=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 Culture=neuU5", Potential IP "4.0.0.0" found in string "n=4.0.0.0 C", Potential IP "4.0.0.0" found in string "ion=4.0.0.0 ", Potential IP "4.0.0.0" found in string "4.0.0.0 Cul", Potential IP "4.0.0.0" found in string "n=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" /" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowDefinition=", "2.5.29.10", "4.0.0.0"41:T80b,"BraveSoftware\Brave-Browser\User Data\Default\Login Data" (Indicator: "bravesoftware\brave-browser\user data") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "BraveSoftware\Brave-Browser\User Data\Local State" (Indicator: "bravesoftware\brave-browser\user data") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Google\Chrome\User Data\Default\Login Data" (Indicator: "google\chrome\user data") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Google\Chrome\User Data\Local State" (Indicator: "google\chrome\user data") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Microsoft\Edge\User Data\Default\Login Data" (Indicator: "microsoft\edge\user data") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Microsoft\Edge\User Data\Local State" (Indicator: "microsoft\edge\user data") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Mozilla\Firefox\Profiles" (Indicator: "mozilla\firefox\") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Opera Software\Opera GX Stable\Login Data" (Indicator: "opera software\opera gx stable\login data") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Opera Software\Opera Stable\Login Data" (Indicator: "opera software\opera stable\login data") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Opera Software\Opera Stable\Local State" (Indicator: "opera software\opera stable\local state") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Yandex\YandexBrowser\User Data\Default\Ya Passman Data" (Indicator: "yandex\yandexbrowser\user data") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin "Yandex\YandexBrowser\User Data\Local State" (Indicator: "yandex\yandexbrowser\user data") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin42:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790610115112,"unified_at":"2026-09-28T15:41:55.112Z","metadata":{"hashes":{"sha256":"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3","sha1":"e3c4f4dc3aada1cb7a98d3d73edf3d58c64f6f6b","md5":"a9db2789f14e86e7d66d97ce42bb3d79","sha512":"0726d3b711437672e85530f92e85955bd36b5a0224799204310c0c00bd25128df9a38f08e4a0747a14ed909791dd8949da19a0dadbdd1e11db98fc95ee6363f6","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"a9db2789f14e86e7d66d97ce42bb3d79.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":3266048,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1687477805000,"last_seen":1687477806000,"last_multi_scan":1687477806000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","criminal","opensource","quasar","rat","targeted","infostealer","evasive"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":47},"sandbox_signatures":{"informative_count":72,"suspicious_count":17,"malicious_count":6,"total":95},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Backdoor/Win32.QuasarRAT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Quasar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1307453","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.MSIL.PasswordStealerA.F21E2206","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Generic-9883083-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.CLQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/Quasar.f","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005690671 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.MSIL.Quasar.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXLX-DS!A9DB2789F14E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Quasar-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Troj.BTX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.QuasarRAT.DRN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Quasar.Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.MSIL.Quasar","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Adjusts debug privileges"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Uses a .NET obfuscator to hide its code"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"malicious","value":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","identifiers":[{"type":"suspicious","value":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"suspicious","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browser information locations related strings"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\".exe\" called \"LoadResource with parameter {'hModule': '2009530368', 'hResInfo': '9569776'}\" (UID: 00000000-00003452)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/3\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/3\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003452.00000000.67512.00290000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003452.00000001.69432.00290000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003452.00000002.71352.00290000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003452.00000003.76898.00290000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003452.00000000.67512.01C40000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003452.00000000.67512.01C40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003452.00000000.67512.01C40000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003452.00000000.67512.01C40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$28","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" with parameter \"3452\" - (UID: 00000000-00003452)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\".exe\" called \"GetWindowTextW\" (UID: 00000000-00003452)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003452)\n \".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00003452)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\".exe\" called \"GetVersionExA\" (UID: 00000000-00003452)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003452)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"Org.BouncyCastle.Asn1.Pkcs.PrivateKeyInfo::GetVersionValue(Org.BouncyCastle.Asn1.DerInteger) at a9db2789f14e86e7d66d97ce42bb3d79-6004ed7-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::GetKeyboardLayout(System.Int32) at a9db2789f14e86e7d66d97ce42bb3d79-6000980-KeyboardNativeMethods~GetActiveKeyboard","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.exe\" at 00000000-00003452-0000010C-10091216654483844","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003452)\n \".exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003452)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"CreateDC\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n Found reference to API (Indicator: \"DeleteDC\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n Found reference to API (Indicator: \"CryptHashData\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n Found reference to API (Indicator: \"GetWindowThreadProcessId\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n Found reference to API (Indicator: \"AddDllDirectory\"; Source: \"00000000-00003452.00000000.67512.01C40000.00000004.mdmp\")\n Found reference to API (Indicator: \"DefWindowProcW\"; Source: \"00000000-00003452.00000000.67512.01C40000.00000004.mdmp\")\n Found reference to API (Indicator: \"DefWindowProcA\"; Source: \"00000000-00003452.00000000.67512.01C40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A\" (Indicator: \"mozilla/5.0 (\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0\" (Indicator: \"mozilla/5.0 (\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"Are you mixing protobuf-net and protobuf-csharp-port? See https://stackoverflow.com/q/11564914/23354; type:\" (Indicator: \"stackoverflow.com\")\n \"; please see https://stackoverflow.com/q/14436606/23354\" (Indicator: \"stackoverflow.com\")\n \"Invalid wire-type; this usually means you have over-written a file without truncating or setting the length; see https://stackoverflow.com/q/2152978/23354\" (Indicator: \"stackoverflow.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67D40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75760000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 689A0000\n \".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 69150000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77BC0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e003cd6d86d@ADVAPI32.dll\"\n \"140015007cd6d86d@ADVAPI32.dll\"\n \"1400150094d6d86d@ADVAPI32.dll\"\n \"0c000d00dcd6d86d@ADVAPI32.dll\"\n \"0c000d00ecd6d86d@ADVAPI32.dll\"\n \"0e000f00fcd6d86d@ADVAPI32.dll\"\n \"1800190064d8d86d@RPCRT4.dll\"\n \"1300140090d8d86d@RPCRT4.dll\"\n \"14001500a4d8d86d@RPCRT4.dll\"\n \"16001700bcd8d86d@RPCRT4.dll\"\n \"0b000c0068d1d86d@WS2_32.dll\"\n \"1b001c00381f986d@api-ms-win-core-synch-l1-2-0.DLL\"\n \"150016003cbad86d@ADVAPI32.dll\"\n \"0e000f00b4bad86d@ADVAPI32.dll\"\n \"0e000f00e8bad86d@ADVAPI32.dll\"\n \"1100120048bfd86d@ADVAPI32.dll\"\n \"11001200b4bfd86d@ADVAPI32.dll\"\n \"12001300c8bfd86d@ADVAPI32.dll\"\n \"12001300f0bfd86d@ADVAPI32.dll\"\n \"14001500b0d4d86d@ADVAPI32.dll\"\n \"14001500c8d4d86d@ADVAPI32.dll\"\n \"14001500e0d4d86d@ADVAPI32.dll\"\n \"17001800f8d4d86d@ADVAPI32.dll\"\n \"0d000e0010d5d86d@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\" was detected as \".NET\" and name: \"Library\"\n \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$31","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\".exe\" queries basic process information of the \"C:\\Windows\\System32\\cryptsp.dll\" (UID: 3452)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Found a reference to an external IP address lookup service","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$39","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://ipwho.is\"\n Found HTTPS url \"https://stackoverflow.com\"\n Found HTTPS url \"https://api.ipify.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\".exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"369164946\"\n \"cx\": \"300\"\n \"cy\": \"30\"}\n \".exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1308689031\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \".exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"369164946\"\n \"cx\": \"6\"\n \"cy\": \"21\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at a9db2789f14e86e7d66d97ce42bb3d79-600003d-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\".exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\cryptsp.dll\" (UID: 00000000-00003452)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003452.00000000.67512.00690000.00000004.mdmp, 00000000-00003452.00000001.69432.00690000.00000004.mdmp, 00000000-00003452.00000002.71352.00690000.00000004.mdmp, 00000000-00003452.00000003.76898.00690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"\"del /a /q /f \"\" (Indicator: \"\"del \") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilegesion=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" />\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003452.00000000.67512.00690000.00000004.mdmp\n 00000000-00003452.00000001.69432.00690000.00000004.mdmp\n 00000000-00003452.00000002.71352.00690000.00000004.mdmp\n 00000000-00003452.00000003.76898.00690000.00000004.mdmp\"), Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003452.00000000.67512.01C40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Antivirus\" (Indicator: \"antivirus\") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00000000-00003452-00000105-2778532","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 3452)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses a .NET obfuscator to hide its code","description":"\"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" is a hint for the obfuscator \"MPRESS\"","origin":"File/Memory","mitre_attack_id":"T1140","relevance":2,"id":"string-6","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"è¤ä¶ç»âè êë¢à«é¿äªì§¢â¹³ä±³ä¼¸ì±ê°ëéå¢::ç°å§ì¿åµºîâé³ïä³ç¼±ì³ï âî¦¤áª±ë £ê´îäë¸(åºã¹¯â§¡é½å°°èª¹ëé½ìæ£ë¬ïåµªá°á§ï¥æ¬ä¤ï¸§ã©,Quasar.Common.Messages.GetSystemInfo) at a9db2789f14e86e7d66d97ce42bb3d79-60001d2-_~Execute\n Quasar.Common.Messages.GetSystemInfoResponse::set_SystemInfos(System.Collections.Generic.List`1>) at a9db2789f14e86e7d66d97ce42bb3d79-60001d3-_~_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT Caption FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n \"SELECT * FROM Win32_BIOS\" (Indicator: \" win32_bios\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n \"SELECT * FROM Win32_BaseBoard\" (Indicator: \" win32_baseboard\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n \"SELECT * FROM Win32_Processor\" (Indicator: \" win32_process\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n \"Select * From Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n \"SELECT * FROM Win32_OperatingSystem WHERE Primary='true'\" (Indicator: \" win32_operatingsystem\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"56/70 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"$3e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$3f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$40","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"System.Diagnostics.Process::GetProcessesByName(System.String) at a9db2789f14e86e7d66d97ce42bb3d79-600003f-_~_\n System.Diagnostics.Process::GetProcessById(System.Int32) at a9db2789f14e86e7d66d97ce42bb3d79-60001e4-_~_\n System.Diagnostics.Process::GetProcessById(System.Int32) at a9db2789f14e86e7d66d97ce42bb3d79-60001de-_~_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"Gma.System.MouseKeyHook.Implementation.KeyboardState::GetKeyState(System.Windows.Forms.Keys) at a9db2789f14e86e7d66d97ce42bb3d79-60009e8-KeyboardState~IsDownRaw\n Gma.System.MouseKeyHook.Implementation.KeyboardState::GetKeyState(System.Windows.Forms.Keys) at a9db2789f14e86e7d66d97ce42bb3d79-60009e9-KeyboardState~IsToggled\n Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::MapVirtualKeyEx(System.Int32,System.Int32,System.IntPtr) at a9db2789f14e86e7d66d97ce42bb3d79-600097c-KeyboardNativeMethods~TryGetCharFromKeyboardState\n Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::GetKeyboardState(System.Byte[]) at a9db2789f14e86e7d66d97ce42bb3d79-60009e5-KeyboardState~GetCurrent\n Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::GetKeyState(System.Int32) at a9db2789f14e86e7d66d97ce42bb3d79-600091c-KeyEventArgsExt~CheckModifier","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"$41","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"GetMac\" (Indicator: \"getmac\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n Found string \"HostName\" (Indicator: \"hostname\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n Found string \"hostname\" (Indicator: \"hostname\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n Found string \"'name' is not a HostName string\" (Indicator: \"hostname\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")\n Found string \"/K CHCP {0}\" (Indicator: \"chcp\"; File: \"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\".exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\System32\\cryptsp.dll\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"DeleteDC\" (Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin, API is part of module: GDI32.DLL)\n Found string \"CryptHashData\" (Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin, API is part of module: CRYPTSP.DLL)\n Found string \"GetCurrentThreadId\" (Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin, API is part of module: KERNELBASE.DLL)\n Found string \"GetWindowThreadProcessId\" (Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin, API is part of module: USER32.DLL)\n Found string \"shutdown\" (Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin, API is part of module: WS2_32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"db4d427300000000\" to virtual address \"0x00292000\" (part of module \"9D16EC73785C06EE7ECCD44C6D8694FFAEC537BE881AC4226BC2095DB312AEA3.EXE\")\n \".exe\" wrote bytes \"624f2542\" to virtual address \"0x6915F798\" (part of module \"CLR.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"56/70 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"https://api.ipify.org/\" (Indicator: \"api.ipify.org\"; File: \"6000217-_~_\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_QuasarStealer\" matched file \"sample.bin\" as \"Detects Quasar infostealer\" (Author: ditekshen)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"\"{0}\\FileZilla\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\n \"{0}\\FileZilla\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: 9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.bin\n \"{0}\\\\FileZilla\\\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 600007d-ctor\n \"{0}\\\\FileZilla\\\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: 600007d-ctor","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Possibly checks for the presence of an Antivirus engine"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":49,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","criminal","opensource","quasar","rat","targeted","infostealer","evasive"],"sandbox_reports":[{"id":"6494ea515dd9329ec0062a83","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.MSIL.PasswordStealerA","submit_name":"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.exe","analysis_start_time":"2023-06-23T00:41:54+00:00","indicators_count":{"informative":72,"suspicious":26,"malicious":6},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}],"processes":[{"pid":3452,"ppid":0,"name":"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.exe","command_line":"","sha256":"9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3","normalized_path":"C:\\9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3.exe","uid":"00000000-00003452","icon":"$42"}],"all_imported_dlls":["nsi.dll","comctl32.dll","advapi32.dll","ole32.dll","rpcrt4.dll","shlwapi.dll","clr.dll","System.Core.ni.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Configuration.ni.dll","bcrypt.dll","nlssorting.dll","System.Windows.Forms.dll","sechost.dll","System.Drawing.ni.dll","System.Windows.Forms.ni.dll","shell32.dll","cryptsp.dll","dwmapi.dll","user32.dll","oleaut32.dll","msvcrt.dll","vcruntime140_clr0400.dll","rsaenh.dll","KernelBase.dll","gdi32.dll","lpk.dll","usp10.dll","imm32.dll","mscoree.dll","VxSSL32.dll","fltLib.dll","msctf.dll","clrjit.dll","System.Xml.ni.dll","kernel32.dll","mscoreei.dll","version.dll","ucrtbase_clr0400.dll","System.ni.dll","profapi.dll","mscorlib.ni.dll","cryptbase.dll","uxtheme.dll","api-ms-win-core-synch-l1-2-0.dll","rpcss.dll","psapi.dll","ntdll.dll","ws2_32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6494ea515dd9329ec0062a83"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6494ea515dd9329ec0062a83"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.MSIL.Quasar Sample 9d16ec73785c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9d16ec73785c…. Malware family: Trojan.MSIL.Quasar. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.MSIL.Quasar Sample 9d16ec73785c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9d16ec73785c…. Malware family: Trojan.MSIL.Quasar. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9d16ec73785c06ee7eccd44c6d8694ffaec537be881ac4226bc2095db312aea3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.MSIL.Quasar Sample 9d16ec73785c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9d16ec73785c…. Malware family: Trojan.MSIL.Quasar. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L43","11",{}]]