24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Doina.Generic Sample a1c483b0ee74… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a1c483b0ee74…. Malware family: Doina.Generic. Threat score 100/100. 25/28 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717","keywords":["Malicious","Doina.Generic","malware analysis","sandbox report","threat intelligence","a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717"],"about":{"@type":"SoftwareApplication","name":"BackdoorDLLworm.bin","applicationCategory":["pedll","executable"],"identifier":"a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Doina.Generic","antivirusDetections":{"malicious":25,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T412,Pattern match: "https://www.google.com/index.html" Heuristic match: "mssscardprv.ax" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "http://www.usertrust.com1" Pattern match: "crl.usertrust.com/UTN-USERFirst-Object.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://crl.thawte.com/ThawtePCA.crl0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://th.symcb.com/th.crl0" Pattern match: "https://www.thawte.com/cps0/" Pattern match: "https://www.thawte.com/repository0W" Pattern match: "http://th.symcd.com0&" Pattern match: "http://th.symcb.com/th.crt0" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sv.symcb.com/sv.crl0W" Pattern match: "http://sv.symcd.com0&" Pattern match: "http://sv.symcb.com/sv.crt0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0"26:T53f,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "DLL#2.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "DLL#2.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp, 00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp")27:T98e,"rundll32.exe" queried SystemProcessInformation at 00000000-00005616-00000C15-1999960562 [PID: 5616] "rundll32.exe" queried SystemProcessInformation at 00000000-00005616-00000C15-2000048082 [PID: 5616] "rundll32.exe" queried SystemProcessInformation at 00000000-00005616-00000C15-2000529415 [PID: 5616] "rundll32.exe" queried SystemProcessInformation at 00000000-00005616-00000C15-2000537882 [PID: 5616] "rundll32.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-1999931519 [PID: 2948] "rundll32.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-1999968964 [PID: 2948] "rundll32.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-2000412635 [PID: 2948] "rundll32.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-2000436639 [PID: 2948] "rundll32.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-2000733852 [PID: 2948] "rundll32.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-2000742167 [PID: 2948] "rundll32.exe" queried SystemProcessInformation at 00000000-00005360-00000C15-1999814665 [PID: 5360] "rundll32.exe" queried SystemProcessInformation at 00000000-00005360-00000C15-1999843967 [PID: 5360] "rundll32.exe" queried SystemProcessInformation at 00000000-00005360-00000C15-2000220306 [PID: 5360] "rundll32.exe" queried SystemProcessInformation at 00000000-00005360-00000C15-2000229337 [PID: 5360] "rundll32.exe" queried SystemProcessInformation at 00000000-00007728-00000C15-1999951358 [PID: 7728] "rundll32.exe" queried SystemProcessInformation at 00000000-00007728-00000C15-1999988712 [PID: 7728] "rundll32.exe" queried SystemProcessInformation at 00000000-00007728-00000C15-2000475030 [PID: 7728] "rundll32.exe" queried SystemProcessInformation at 00000000-00007728-00000C15-2000486036 [PID: 7728] "rundll32.exe" queried SystemProcessInformation at 00000000-00004468-00000C15-2004541448 [PID: 4468] "rundll32.exe" queried SystemProcessInformation at 00000000-00004468-00000C15-2004550137 [PID: 4468] "rundll32.exe" queried SystemProcessInformation at 00000000-00004468-00000C15-2004748352 [PID: 4468] "rundll32.exe" queried SystemProcessInformation at 00000000-00004468-00000C15-2004756597 [PID: 4468] "rundll32.exe" queried SystemProcessInformation at 00000000-00004468-00000C15-2004910023 [PID: 4468] "rundll32.exe" queried SystemProcessInformation at 00000000-00004468-00000C15-2004934426 [PID: 4468]28:Tece,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005616) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002948) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002948) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005360) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007728) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004468)29:Ta51,"rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005616) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005616) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005616) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005616) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002948) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002948) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002948) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002948) "rundll32.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002948) "rundll32.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00002948) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005360) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005360) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005360) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005360) "rundll32.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00005360) "rundll32.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005360) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007728) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007728) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007728) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007728) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004468) "rundll32.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00004468)2a:Tb55e,"rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter WSACleanup (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter WSAAsyncSelect (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetLastError (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter connect (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter listen (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter accept (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter htons (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter htonl (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter inet_addr (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter inet_ntoa (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter gethostbyname (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter gethostname (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00005616) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter WSACleanup (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter WSAAsyncSelect (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetLastError (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter connect (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter listen (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter accept (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter htons (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter htonl (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter inet_addr (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter inet_ntoa (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter gethostbyname (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter gethostname (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter RemoveDirectoryA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter MoveFileA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleFileNameExA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter GetAdaptersInfo (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter WTSEnumerateSessionsA (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter WTSFreeMemory (UID: 00000000-00002948) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter WSACleanup (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter WSAAsyncSelect (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetLastError (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter connect (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter listen (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter accept (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter htons (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter htonl (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter inet_addr (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter inet_ntoa (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter gethostbyname (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter gethostname (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter RemoveDirectoryA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter MoveFileA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter RegisterServiceCtrlHandlerExA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00005360) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter WSACleanup (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter WSAAsyncSelect (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetLastError (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter connect (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter listen (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter accept (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter htons (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter htonl (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter inet_addr (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter inet_ntoa (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter gethostbyname (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter gethostname (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00007728) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter WSACleanup (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter WSAAsyncSelect (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter WSAGetLastError (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter connect (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter listen (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter accept (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter htons (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter htonl (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter inet_addr (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter inet_ntoa (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter gethostbyname (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter gethostname (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter RemoveDirectoryA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter MoveFileA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetModuleFileNameExA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter GetAdaptersInfo (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter WTSEnumerateSessionsA (UID: 00000000-00004468) "rundll32.exe" called "GetProcAddress" with a parameter WTSFreeMemory (UID: 00000000-00004468)2b:Teea,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00002948.00000000.192624.03160000.00000004.mdmp, 00000000-00002948.00000001.192904.03160000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002948.00000000.192624.03160000.00000004.mdmp, 00000000-00002948.00000001.192904.03160000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002948.00000000.192624.03160000.00000004.mdmp, 00000000-00002948.00000001.192904.03160000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002948.00000000.192624.03160000.00000004.mdmp, 00000000-00002948.00000001.192904.03160000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00004468.00000000.192958.034E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004468.00000000.192958.034E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004468.00000000.192958.034E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004468.00000000.192958.034E0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005360.00000000.192626.03450000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005360.00000000.192626.03450000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005360.00000000.192626.03450000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005360.00000000.192626.03450000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005616.00000000.192624.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005616.00000000.192624.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005616.00000000.192624.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00005616.00000000.192624.030C0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00007728.00000000.192627.02F20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00007728.00000000.192627.02F20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00007728.00000000.192627.02F20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00007728.00000000.192627.02F20000.00000004.mdmp")2c:T46a1,Found reference to API (Indicator: "SetServiceStatus"; File: "DLL#2.bin") Found reference to API (Indicator: "FindFirstFileA"; File: "DLL#2.bin") Found reference to API (Indicator: "Sleep"; File: "DLL#2.bin") Found reference to API (Indicator: "LocalAlloc"; File: "DLL#2.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "DLL#2.bin") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "DLL#2.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "DLL#2.bin") Found reference to API (Indicator: "GetTickCount"; File: "DLL#2.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "DLL#2.bin") Found reference to API (Indicator: "RemoveDirectoryA"; File: "DLL#2.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "DLL#2.bin") Found reference to API (Indicator: "FindNextFileA"; File: "DLL#2.bin") Found reference to API (Indicator: "GetLocaleInfoA"; File: "DLL#2.bin") Found reference to API (Indicator: "GetVersionExA"; File: "DLL#2.bin") Found reference to API (Indicator: "OutputDebugStringA"; File: "DLL#2.bin") Found reference to API (Indicator: "GlobalFree"; File: "DLL#2.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "DLL#2.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "DLL#2.bin") Found reference to API (Indicator: "GetLocalTime"; File: "DLL#2.bin") Found reference to API (Indicator: "CreateThread"; File: "DLL#2.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "DLL#2.bin") Found reference to API (Indicator: "CloseHandle"; File: "DLL#2.bin") Found reference to API (Indicator: "GlobalAlloc"; File: "DLL#2.bin") Found reference to API (Indicator: "FindClose"; File: "DLL#2.bin") Found reference to API (Indicator: "SetFileAttributesA"; File: "DLL#2.bin") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "DLL#2.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "DLL#2.bin") Found reference to API (Indicator: "GetProcAddress"; File: "DLL#2.bin") Found reference to API (Indicator: "ShowWindow"; File: "DLL#2.bin") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002948.00000000.192624.00BE1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002948.00000000.192624.00BE1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002948.00000000.192624.00BE1000.00000020.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00002948.00000000.192624.00BE1000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00002948.00000000.192624.00BE1000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00002948.00000000.192624.00BE1000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002948.00000000.192624.00BE1000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00002948.00000000.192624.00BE1000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00002948.00000000.192624.00BE1000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002948.00000000.192624.00BE1000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00002948.00000000.192624.00BE1000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00002948.00000000.192624.00BE1000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002948.00000000.192624.00BE1000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00002948.00000000.192624.00BE1000.00000020.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp, 00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp, 00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp, 00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp, 00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp, 00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp, 00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp, 00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp, 00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp, 00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp, 00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00002948.00000000.192624.00BE9000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp") Found reference to API (Indicator: "SetServiceStatus"; Source: "00000000-00002948.00000000.192624.1000B000.00000002.mdmp")2d:T7a7,"rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74e00000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74e00000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74e00000 "rundll32.exe" loaded module "KERNEL32" at base 754f0000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72fe0000 "rundll32.exe" loaded module "C:\DLL#2.BIN.DLL" at base 10000000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74140000 "rundll32.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 754f0000 "rundll32.exe" loaded module "PSAPI.DLL" at base 746b0000 "rundll32.exe" loaded module "WTSAPI32.DLL" at base 74300000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 72fc0000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 74fe0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 72fa0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 72f80000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73480000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 72f70000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 754f0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72f20000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72f10000 "rundll32.exe" loaded module "OLEAUT32.DLL" at base 751c0000 "rundll32.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 752e0000 "rundll32.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 752e0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74720000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77020000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74970000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 750f00002e:T9b9,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\00F5AF79-374F59EE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\00F5AF79"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\0000000B"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "")2f:Td92,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACINGFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CFGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "")30:T64f,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002948.00000000.192624.03160000.00000004.mdmp, 00000000-00002948.00000001.192904.03160000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002948.00000000.192624.03160000.00000004.mdmp, 00000000-00002948.00000001.192904.03160000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004468.00000000.192958.034E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004468.00000000.192958.034E0000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005360.00000000.192626.03450000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005360.00000000.192626.03450000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005616.00000000.192624.030C0000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005616.00000000.192624.030C0000.00000004.mdmp") Found string "NDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007728.00000000.192627.02F20000.00000004.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00007728.00000000.192627.02F20000.00000004.mdmp")31:T604,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")32:T564,"rundll32.exe" called "GetAdaptersInfo" with parameter "00000000090000007b44303344423043312d323732392d343637342d413837352d3836323544443738343330307d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000496e74656c2852292050524f2f31303030204d54204e6574776f726b20436f6e6e656374696f6e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000002e17d11ce4bb000009000000060000000100000000000000000000003139322e3136382e302e3200000000003235352e3235352e3235352e30000000c0a80002000000003139322e3136382e302e3100000000003235352e3235352e3235352e32353500c0a80001000000003139322e3136382e302e3100000000003235352e3235352e3235352e32353500c0a80001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b7151969931b1969a7bb57f81a370000" - (UID: 00000000-00002948)33:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC34:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC35:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC36:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC37:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC38:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC39:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790362142950,"unified_at":"2026-09-25T18:49:02.950Z","metadata":{"hashes":{"sha256":"a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717","sha1":"6b1ddf0e63e04146d68cd33b0e18e668b29035c4","md5":"4613f51087f01715bf9132c704aea2c2","sha512":"37fa5336d1554557250e4a3bcb4ccfca79f4873264cb161dee340d35a2f8f17f7853fe942809bb343ac1eae0a37122b5e8fd703a9b820ec96abb65c8327c1b6a","ssdeep":"768:qtT2AxNtcgpqLepcy2y6/chYdP8KuSFM+Cs5CBaho9S4AJKqBz8MZdVsrQVBnVGa:qwONtBqL1dDMrs5CN9S4A3HOYBnVL","ssdeep_chunks":["768:qtT2AxN","768:tT2AxNt","768:T2AxNtc","768:2AxNtcg","768:AxNtcgp","768:xNtcgpq","768:NtcgpqL","768:tcgpqLe","768:cgpqLep","768:gpqLepc","768:pqLepcy","768:qLepcy2","768:Lepcy2y","768:epcy2y6","768:pcy2y6/","768:cy2y6/c","768:y2y6/ch","768:2y6/chY","768:y6/chYd","768:6/chYdP","768:/chYdP8","768:chYdP8K","768:hYdP8Ku","768:YdP8KuS","768:dP8KuSF","768:P8KuSFM","768:8KuSFM+","768:KuSFM+C","768:uSFM+Cs","768:SFM+Cs5","768:FM+Cs5C","768:M+Cs5CB","768:+Cs5CBa","768:Cs5CBah","768:s5CBaho","768:5CBaho9","768:CBaho9S","768:Baho9S4","768:aho9S4A","768:ho9S4AJ","768:o9S4AJK","768:9S4AJKq","768:S4AJKqB","768:4AJKqBz","768:AJKqBz8","768:JKqBz8M","768:KqBz8MZ","768:qBz8MZd","768:Bz8MZdV","768:z8MZdVs","768:8MZdVsr","768:MZdVsrQ","768:ZdVsrQV","768:dVsrQVB","768:VsrQVBn","768:srQVBnV","768:rQVBnVG","768:QVBnVGa","1536:qtT2AxN","1536:tT2AxNt","1536:T2AxNtc","1536:2AxNtcg","1536:AxNtcgp","1536:xNtcgpq","1536:NtcgpqL","1536:tcgpqLe","1536:cgpqLep","1536:gpqLepc","1536:pqLepcy","1536:qLepcy2","1536:Lepcy2y","1536:epcy2y6","1536:pcy2y6/","1536:cy2y6/c","1536:y2y6/ch","1536:2y6/chY","1536:y6/chYd","1536:6/chYdP","1536:/chYdP8","1536:chYdP8K","1536:hYdP8Ku","1536:YdP8KuS","1536:dP8KuSF","1536:P8KuSFM","1536:8KuSFM+","1536:KuSFM+C","1536:uSFM+Cs","1536:SFM+Cs5","1536:FM+Cs5C","1536:M+Cs5CB","1536:+Cs5CBa","1536:Cs5CBah","1536:s5CBaho","1536:5CBaho9","1536:CBaho9S","1536:Baho9S4","1536:aho9S4A","1536:ho9S4AJ","1536:o9S4AJK","1536:9S4AJKq","1536:S4AJKqB","1536:4AJKqBz","1536:AJKqBz8","1536:JKqBz8M","1536:KqBz8MZ","1536:qBz8MZd","1536:Bz8MZdV","1536:z8MZdVs","1536:8MZdVsr","1536:MZdVsrQ","1536:ZdVsrQV","1536:dVsrQVB","1536:VsrQVBn","1536:srQVBnV","1536:rQVBnVG","1536:QVBnVGa","768:qwONtBq","768:wONtBqL","768:ONtBqL1","768:NtBqL1d","768:tBqL1dD","768:BqL1dDM","768:qL1dDMr","768:L1dDMrs","768:1dDMrs5","768:dDMrs5C","768:DMrs5CN","768:Mrs5CN9","768:rs5CN9S","768:s5CN9S4","768:5CN9S4A","768:CN9S4A3","768:N9S4A3H","768:9S4A3HO","768:S4A3HOY","768:4A3HOYB","768:A3HOYBn","768:3HOYBnV","768:HOYBnVL"],"imphash":"f6f7b2e00921129d18061822197111cd"},"file_info":{"file_name":"BackdoorDLLworm.bin","file_type":["pedll","executable"],"file_type_id":"dll","file_size":77824,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1521645445000,"last_seen":1763222819000,"last_multi_scan":1763222819000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["tag","backdoor","brambul","generictargeted","joanap","scadprv","targeted","trojan","pabueri"]},"stats":{"av":{"malicious_count":25,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":50},"sandbox_signatures":{"informative_count":105,"suspicious_count":10,"malicious_count":6,"total":121},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Dllbot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[APT]/Win32.Lazarus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.APTLazarus.vjxcz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.13449","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-1388765","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Backdoor_Win32_Joanap_B_dha","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.13449 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Scadprv.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Worm.Agent.ago.thfj.dll","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Joanap.bot!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0001659c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.cwccco","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Backdoor.Duzzer.A5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Scadprv-C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Worm/W32.Agent.77824.CJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"W32/FunCash!worm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Joanap.A.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent3.BAPF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Worm.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_60.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Worm.Agent.Win32.5702","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Doina.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"malicious","value":"References suspicious system modules"}],"sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Calls an API typically used to retrieve the host name of a computer"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match – ROR algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"suspicious","value":"Calls an API typically used to retrieves adapter information"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Attempts to call internet-related API for network communication"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"mi_exe_stub.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"},{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"rundll32.exe\" with commandline \"\"C:\\a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717.exe.dll\",?nMssvcdll@@3HA\" (UID: 00014176-00002128)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717.exe.dll\",??0CMssvcdll@@QAE@XZ\" (UID: 00014385-00002448)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717.exe.dll\",?fnMssvcdll@@YAHXZ\" (UID: 00014590-00002832)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717.exe.dll\",ServiceMain\" (UID: 00014795-00002976)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717.exe.dll\",??4CMssvcdll@@QAEAAV0@ABV0@@Z\" (UID: 00014998-00002572)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"},{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$25","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"},{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"rundll32.exe\" wrote bytes \"92e67b7779a88077be728077d62d80771de27b7705a28077bee37b77616f807768417e7700507e7700000000ad37a3768b2da376b641a37600000000\" to virtual address \"0x74E61000\" (part of module \"WSHTCPIP.DLL\")\n \"rundll32.exe\" wrote bytes \"40537e7758587f77186a7f77653c80770000000000bf93770000000056cc9377000000007cca93770000000037689b756a2c8077d62d80770000000020699b750000000029a6937700000000a48d9b7500000000f70e937700000000\" to virtual address \"0x779D1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"},{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717.exe.dll.bin\" was detected as \"Microsoft visual C++ 6.0 DLL\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"},{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates a system file in windows directory","description":"\"rundll32.exe\" created file \"%WINDIR%\\System32\\mssscardprv.ax\"\n \"rundll32.exe\" created file \"%WINDIR%\\system32\\mssscardprv.ax\"","origin":"API Call","relevance":7,"id":"api-5","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetTickCount\n GetVersionExA\n LoadLibraryA\n GetModuleFileNameA\n GetProcAddress\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n FindNextFileA\n Sleep\n OutputDebugStringA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"},{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"51/63 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"},{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"51/63 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"},{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"csrss.exe\"","origin":"File/Memory","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"},{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"rundll32.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00002552) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00002552) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"rundll32.exe\" with commandline \"\"C:\\BackdoorDLLworm.bin.dll\",#1\" (UID: 00000000-00002552)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\BackdoorDLLworm.bin.dll\",#2\" (UID: 00000000-00003120)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\BackdoorDLLworm.bin.dll\",#3\" (UID: 00000000-00003708)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\BackdoorDLLworm.bin.dll\",#4\" (UID: 00000000-00003160)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 3120 -s 260\" (UID: 00000000-00002912)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\BackdoorDLLworm.bin.dll\",#5\" (UID: 00000000-00001900)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1900 -s 260\" (UID: 00000000-00000540)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"rundll32.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"rundll32.exe\" touched file \"%WINDIR%\\SysWOW64\\mssscardprv.ax\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"rundll32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"APT_TA18_149A_Joanap_Sample3\" classified file \"a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717.bin\" as \"joanap,backdoor,trojan\" based on indicators: \"mssvcdll.dll,https://www.google.com/index.html,4c004f00470049004e0044004c004700,rundll,%%s\\%%s%%0%dd.%%s,%%s\\%%s%%0%dd\" (Reference: https://www.us-cert.gov/ncas/alerts/TA18-149A, Author: Florian Roth)\n Internal YARA signature matched on file \"all.bstring\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"DLL#2.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"DLL#2.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$27","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00005512]\n Process \"WerFault.exe\" [UID: 00000000-00000208]\n Process \"WerFault.exe\" [UID: 00000000-00007380]\n Process \"WerFault.exe\" [UID: 00000000-00006148]\n Process \"WerFault.exe\" [UID: 00000000-00003268]\n Process \"WerFault.exe\" [UID: 00000000-00005880]\n Process \"WerFault.exe\" [UID: 00000000-00003312]\n Process \"WerFault.exe\" [UID: 00000000-00001048]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"DLL#2.bin\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"DLL#2.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameA\" (Source: \"00000000-00005360.00000000.192626.03450000.00000004.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00007728.00000000.192627.02F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSEnumerateSessionsA\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00002948-00000C2B-2000786373\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00002948-00000C2B-2000786399\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"DLL#2.bin\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002948)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"rundll32.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00002948)\n \"rundll32.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004468)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005616)\n \"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002948)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002948)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005360)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004468)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"DLL#2.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"DLL#2.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"DLL#2.bin\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"DLL#2.bin\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"rundll32.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"rundll32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D03DB0C1-2729-4674-A875-8625DD784300}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00002948-00000C2B-2000660829\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: DLL#2.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00002948.00000000.192624.03160000.00000004.mdmp, 00000000-00002948.00000001.192904.03160000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00004468.00000000.192958.034E0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00005360.00000000.192626.03450000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00005616.00000000.192624.030C0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"WinExec\"; Source: \"00000000-00007728.00000000.192627.02F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"DLL#2.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"DLL#2.bin\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"DLL#2.bin\" contains export function called \"??0CMssvcdll@@QAE@XZ\" at ordinal 1\n \"DLL#2.bin\" contains export function called \"??4CMssvcdll@@QAEAAV0@ABV0@@Z\" at ordinal 2\n \"DLL#2.bin\" contains export function called \"?fnMssvcdll@@YAHXZ\" at ordinal 4\n \"DLL#2.bin\" contains export function called \"?nMssvcdll@@3HA\" at ordinal 5\n \"DLL#2.bin\" contains export function called \"ServiceMain\" at ordinal 3","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00002948.00000000.192624.03160000.00000004.mdmp\n 00000000-00002948.00000001.192904.03160000.00000004.mdmp\n \"stry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00004468.00000000.192958.034E0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"Process \"rundll32.exe\" with commandline \"\"C:\\\\DLL#2.bin.dll\",#1\" (UID: 00000000-00005616)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\DLL#2.bin.dll\",#2\" (UID: 00000000-00002948)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\DLL#2.bin.dll\",#3\" (UID: 00000000-00005360)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\DLL#2.bin.dll\",#4\" (UID: 00000000-00007728)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\DLL#2.bin.dll\",#5\" (UID: 00000000-00004468)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00002948.00000000.192624.03160000.00000004.mdmp\n \"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00002948.00000001.192904.03160000.00000004.mdmp\n \"stry\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00004468.00000000.192958.034E0000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 746C0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73550000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74FE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"DLL#2.bin\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"DLL#2.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"DLL#2.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"DLL#2.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"DLL#2.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"DLL#2.bin\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\tebx,mov\tebx, dword ptr [ebp + 8],push\tesi,mov\tesi, dword ptr [ebp + 0xc],push\tedi,mov\tedi, dword ptr [ebp + 0x10],test\tesi, esi,jne\t0x1000abff,cmp\tdword ptr [0x1001dd88], 0,jmp\t0x1000ac25,cmp\tesi, 1,je\t0x1000ac09,cmp\tesi, 2,jne\t0x1000ac2b,mov\teax, dword ptr [0x1001dd98],test\teax, eax,je\t0x1000ac1b,push\tedi,push\tesi,push\tebx,call\teax,test\teax, eax,je\t0x1000ac27,push\tedi,push\tesi,push\tebx,call\t0x1000ab38,test\teax, eax,jne\t0x1000ac2b,xor\teax, eax,jmp\t0x1000ac79,push\tedi,push\tesi,push\tebx,call\t0x10008430,cmp\tesi, 1,mov\tdword ptr [ebp + 0xc], eax,jne\t0x1000ac47,test\teax, eax,jne\t0x1000ac76,push\tedi,push\teax,push\tebx,call\t0x1000ab38,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"DLL#2.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RegisterServiceCtrlHandlerExA\" (Indicator: \"RegisterServiceCtrlHandler\"; File: \"DLL#2.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"DLL#2.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"rundll32.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 5616)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\rundll32.exe\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcLayers.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\sfc.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\winspool.drv\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\rpcss.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\DLL#2.BIN.DLL.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\DLL#2.bin.dll.manifest\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\DLL#2.BIN.DLL.123.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\DLL#2.BIN.DLL.124.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\DLL#2.BIN.DLL.2.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005616-00000C2B-2000650090\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00005616-00000C2B-2000650090\")\n Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; Source: \"00000000-00005616-00000C2B-2000650113\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"wsagetlasterror\"; Source: \"00000000-00005616-00000C2B-2000650155\")\n Found reference to API \"inet_addr\" (Indicator: \"inet_addr\"; Source: \"00000000-00005616-00000C2B-2000650481\")\n Found reference to API \"inet_ntoa\" (Indicator: \"inet_ntoa\"; Source: \"00000000-00005616-00000C2B-2000650500\")\n Found reference to API \"gethostbyname\" (Indicator: \"gethostbyname\"; Source: \"00000000-00005616-00000C2B-2000650521\")\n Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"00000000-00005616-00000C2B-2000650552\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.google.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on process \"00000000-00002948\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file file \"sample.bin\"\n YARA signature to detect medium entropy file process \"00000000-00002948\"\n YARA signature to detect medium entropy file process \"00000000-00004468\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00005616\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"\n YARA signature for RC4 encryption matched on process \"00000000-00004468\"\n YARA signature for RC4 encryption matched on process \"00000000-00007728\"\n YARA signature for RC4 encryption matched on process \"00000000-00005360\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – ROR algorithm","description":"YARA signature matched on R0R instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-209","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"DLL#2.bin\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"DLL#2.bin\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"DLL#2.bin\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"DLL#2.bin\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"DLL#2.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp, 00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; File: \"DLL#2.bin\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"DLL#2.bin\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp, 00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"DLL#2.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp, 00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"NtQueryInformationToken\" (Indicator: \"NtQueryInformationToken\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"NtOpenProcessToken\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002948-00000C2B-2000660456\")\n Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$30","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"DLL#2.bin\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"DLL#2.bin\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002948.00000000.192624.1000B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00005616-00000C2B-2000650390","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002948.00000000.192624.00BE9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"DLL#2.bin\" has section name .text with entropy \"6.506011097540984\"\n \"DLL#2.bin\" has section name .rdata with entropy \"6.655349297369005\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"rundll32.exe queries ProcessDebugPort (UID: 2948), \"rundll32.exe queries ProcessDebugPort (UID: 4468)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to retrieve the host name of a computer","description":"\"rundll32.exe\" called \"gethostname\" with parameter DESKTOP-FVVF82A & 255 (UID: 00000000-00002948)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-225","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"rundll32.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00005616)\n \"rundll32.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00005616)\n \"rundll32.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00002948)\n \"rundll32.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00002948)\n \"rundll32.exe\" called \"NtAlpcConnectPortEx\" with parameters (UID: 00000000-00002948)\n \"rundll32.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00002948)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"42010945\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"160109fc\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieves adapter information","description":"$32","origin":"API Call","mitre_attack_id":"T1016","relevance":5,"id":"api-153","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 440 -p 2948 -ip 2948\" (UID: 00000000-00005512)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 2948 -s 720\" (UID: 00000000-00000208)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 2948 -s 720\" (UID: 00000000-00007380)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 2948 -s 720\" (UID: 00000000-00006148)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 508 -p 4468 -ip 4468\" (UID: 00000000-00003268)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 4468 -s 724\" (UID: 00000000-00005880)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 4468 -s 724\" (UID: 00000000-00003312)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 4468 -s 724\" (UID: 00000000-00001048)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the windows installation language"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]}]},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":77,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":13,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["tag","backdoor","brambul","generictargeted","joanap","scadprv","targeted","trojan","pabueri"],"sample_flags":["Multi-Process","Sample Crashed","User Comment"],"sandbox_reports":[{"id":"6918a522088fa93c3202d524","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"DLL#2.bin","analysis_start_time":"2025-11-15T16:06:59+00:00","indicators_count":{"informative":104,"suspicious":12,"malicious":3},"tags":["Multi-Process","Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"61d47cbd93539325687be1f2","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Worm.Agent","submit_name":"BackdoorDLLworm.bin","analysis_start_time":"2022-01-04T16:58:49+00:00","indicators_count":{"informative":10,"suspicious":5,"malicious":5},"tags":["Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"5ce668be028838b035c20a48","environment_id":300,"environment_description":"Linux (Ubuntu 16.04, 64 bit)","state":"ERROR","error_type":"The requested environment ID \"300\" and file type \"dll\" have no available execution environment","verdict":"undetected","submit_name":"BackdoorDLLworm.bin","analysis_start_time":"2019-05-23T09:32:46+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5ab275417ca3e1212d3fdd4c","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Worm.Agent","submit_name":"a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717.exe","analysis_start_time":"2018-03-21T16:07:52+00:00","indicators_count":{"informative":7,"suspicious":2,"malicious":4},"tags":["Multi-Process","Sample Crashed","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}],"processes":[{"pid":728,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00000728"},{"pid":5616,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\DLL#2.bin.dll\",#1","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00005616","icon":"$33"},{"pid":2948,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\DLL#2.bin.dll\",#2","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00002948","icon":"$34"},{"pid":208,"ppid":2948,"name":"WerFault.exe","command_line":"-u -p 2948 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002948","uid":"00000000-00000208"},{"pid":7380,"ppid":2948,"name":"WerFault.exe","command_line":"-u -p 2948 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002948","uid":"00000000-00007380"},{"pid":6148,"ppid":2948,"name":"WerFault.exe","command_line":"-u -p 2948 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002948","uid":"00000000-00006148"},{"pid":5360,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\DLL#2.bin.dll\",#3","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00005360","icon":"$35"},{"pid":7728,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\DLL#2.bin.dll\",#4","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007728","icon":"$36"},{"pid":5512,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 2948 -ip 2948","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005512","icon":"$37"},{"pid":4468,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\DLL#2.bin.dll\",#5","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004468","icon":"$38"},{"pid":5880,"ppid":4468,"name":"WerFault.exe","command_line":"-u -p 4468 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004468","uid":"00000000-00005880"},{"pid":3312,"ppid":4468,"name":"WerFault.exe","command_line":"-u -p 4468 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004468","uid":"00000000-00003312"},{"pid":1048,"ppid":4468,"name":"WerFault.exe","command_line":"-u -p 4468 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004468","uid":"00000000-00001048"},{"pid":3268,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 508 -p 4468 -ip 4468","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003268","icon":"$39"}],"all_imported_dlls":["kernel32.dll","imagehlp.dll","sspicli.dll","shell32.dll","nsi.dll","rpcrt4.dll","ole32.dll","msctf.dll","winnsi.dll","NapiNSP.dll","winrnr.dll","profapi.dll","imm32.dll","uxtheme.dll","gdi32.dll","usp10.dll","sechost.dll","nlaapi.dll","mswsock.dll","dnsapi.dll","WSHTCPIP.DLL","ntdll.dll","user32.dll","lpk.dll","apphelp.dll","shlwapi.dll","userenv.dll","a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717.exe.dll","ws2_32.dll","IPHLPAPI.DLL","wtsapi32.dll","pnrpnsp.dll","cryptbase.dll","clbcatq.dll","KernelBase.dll","msvcrt.dll","AcLayers.dll","advapi32.dll","dwmapi.dll","FWPUCLNT.DLL","rasadhlp.dll","dhcpcsvc.dll","oleaut32.dll","mpr.dll","psapi.dll","rpcss.dll","BackdoorDLLworm.bin.dll","api-ms-win-core-synch-l1-2-0.dll","wow64.dll","wow64cpu.dll","version.dll","acwow64.dll","wow64win.dll","bcrypt.dll","sfc.dll","sfc_os.dll","CoreUIComponents.dll","gdi32full.dll","setupapi.dll","DLL#2.bin.dll","win32u.dll","msvcp_win.dll","cryptsp.dll","kernel.appcore.dll","ntmarta.dll","cfgmgr32.dll","ucrtbase.dll","windows.storage.dll","TextInputFramework.dll","WinTypes.dll","bcryptprimitives.dll","VxSSL32.dll","CoreMessaging.dll","fltLib.dll","SHCore.dll","combase.dll","powrprof.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\System32\\mssscardprv.ax","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"}]},{"path":"%WINDIR%\\System32\\WerFault.exe","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"}]},{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"}]},{"path":"%WINDIR%\\system32\\mssscardprv.ax","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"path":"%WINDIR%\\SysWOW64\\mssscardprv.ax","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5ab275417ca3e1212d3fdd4c"},{"report_type":"sandbox","report_id":"61d47cbd93539325687be1f2"},{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"name":"Local\\SM0:2948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4468:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]},{"name":"Local\\SM0:4468:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6918a522088fa93c3202d524"}]}]}},"report_ids":{"sandbox_job_ids":["6918a522088fa93c3202d524","61d47cbd93539325687be1f2","5ab275417ca3e1212d3fdd4c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Doina.Generic Sample a1c483b0ee74… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a1c483b0ee74…. Malware family: Doina.Generic. Threat score 100/100. 25/28 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717"}],["$","meta","4",{"property":"og:title","content":"Malicious Doina.Generic Sample a1c483b0ee74… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a1c483b0ee74…. Malware family: Doina.Generic. Threat score 100/100. 25/28 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Doina.Generic Sample a1c483b0ee74… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a1c483b0ee74…. Malware family: Doina.Generic. Threat score 100/100. 25/28 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3a","11",{}]]