24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ce,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample a82af7127b9a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a82af7127b9a…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 6/28 AV engines flagged this file. 3 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a82af7127b9a6eb4a85f49a8a86ff09e155dfec3fa0d5387726c1c993a4cd947","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","a82af7127b9a6eb4a85f49a8a86ff09e155dfec3fa0d5387726c1c993a4cd947"],"about":{"@type":"SoftwareApplication","name":"P.O 2023-03902.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"a82af7127b9a6eb4a85f49a8a86ff09e155dfec3fa0d5387726c1c993a4cd947","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":6,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4e5,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp")26:Ta78,Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "P.O 2023-03902") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "P.O 2023-03902") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "P.O 2023-03902") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "P.O 2023-03902") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "P.O 2023-03902") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "P.O 2023-03902") Found reference to "TripleDES" (Indicator: "TripleDES"; File: "P.O 2023-03902") Found reference to "Rijndael" (Indicator: "Rijndael"; File: "P.O 2023-03902") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp")27:T609,Found PE header "MZ" - Source: "00000000-00001072.00000000.82930.FFCA0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00001072.00000001.83392.FFCA0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003700.00000000.66725.002B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003700.00000000.66725.01040000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003700.00000000.66725.02750000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003700.00000001.68648.002B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003700.00000001.68648.01040000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003700.00000001.68648.02750000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003700.00000002.70572.002B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003700.00000002.70572.01040000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003700.00000002.70572.02750000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003700.00000003.89547.002B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003700.00000003.89547.01040000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000000.88183.FF450000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004176.00000001.88577.FF450000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004552.00000000.78710.FF6C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004552.00000001.79544.FF6C0000.00000002.mdmp")28:T9f2,"P.O2023-03902.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000c00c0009d0100000000000000000000b87799000000000020000000000000000000000030559b00a8749900c875990000a99b00707999003054e97390f45c00feffffffecf65c0045588677733d0100feffffff0ce4817772e1817764c5db76d04282770000000000000000000000000000000000000000010000000000000000008b760000000090f55c00000000000000000000000000a4f55c00000000000000000000000000000000003db1ea0898f55c007c1f9f76020000000000000064c5db7600a99b0064c5db7600000000 (UID: 00000000-00003700) "P.O2023-03902.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003700) "P.O2023-03902.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003700) "P.O2023-03902.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000098389900000000007f27000000270000883799007f07000050039d0000000000ff070000c4f13d008000000054f33d00455886777b270100feffffff000000000200000268bc9c0050039d0001000000eb59267700000000ff070000d8f23d00932700b4c40099000100000050039d00020000000c00000050039d0050039d004b039d0000000000ac78e900000099000000000144f23d000742e97364f83d00455886775b270100feffffff163482774134827794000000a00000004a039d0048039d0094000000e8f33d00b9142677300e00008cf33d0090f33d0010000000 (UID: 00000000-00003700)29:T74b,Found reference to API "11357116023,3784,3024,,RtlGetVersion,NTDLL.dll,"00:21:33.529",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00001072.00000000.82930.002A0000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp")2a:T7fa,"P.O2023-03902.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2b:T906,"P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "P.O2023-03902.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "P.O2023-03902.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "P.O2023-03902.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "P.O2023-03902.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "P.O2023-03902.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "P.O2023-03902.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "P.O2023-03902.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "P.O2023-03902.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "P.O2023-03902.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "P.O2023-03902.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "P.O2023-03902.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "P.O2023-03902.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")2c:T57f,"P.O2023-03902.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "P.O2023-03902.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB")2d:Ta6a0,Found reference to API (Indicator: "CreateEvent"; File: "P.O 2023-03902") Found reference to API (Indicator: "SetEvent"; File: "P.O 2023-03902") Found reference to API (Indicator: "ResetEvent"; File: "P.O 2023-03902") Found reference to API (Indicator: "GetLength"; File: "P.O 2023-03902") Found reference to API (Indicator: "DeleteObject"; File: "P.O 2023-03902") Found reference to API (Indicator: "GetObject"; File: "P.O 2023-03902") Found reference to API (Indicator: "SelectObject"; File: "P.O 2023-03902") Found reference to API (Indicator: "Beep"; Source: "00000000-00001072.00000000.82930.7EFE0000.00000002.mdmp, 00000000-00001072.00000001.83392.7EFE0000.00000002.mdmp, 00000000-00004176.00000000.88183.7EFE0000.00000002.mdmp, 00000000-00004176.00000001.88577.7EFE0000.00000002.mdmp, 00000000-00004552.00000000.78710.7EFE0000.00000002.mdmp, 00000000-00004552.00000001.79544.7EFE0000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "InitializeSid"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetSidLengthRequired"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "AddAce"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetAclInformation"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "ProgIDFromCLSID"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "RtlFreeHeap"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "RtlAllocateHeap"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API (Indicator: "SetupDiGetDeviceRegistryPropertyA"; Source: "00000000-00003700.00000000.66725.003CC000.00000004.mdmp") Found reference to API (Indicator: "CreateEvent"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp")2e:T2acb,"\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00001072.00000000.82930.002A0000.00000004.mdmp 00000000-00001072.00000001.83392.0030E000.00000004.mdmp 00000000-00004176.00000000.88183.00300000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00001072.00000000.82930.002A0000.00000004.mdmp 00000000-00001072.00000001.83392.0030E000.00000004.mdmp 00000000-00001072.00000001.83392.0035F000.00000004.mdmp 00000000-00004176.00000000.88183.00300000.00000004.mdmp 00000000-00004176.00000001.88577.00369000.00000004.mdmp 00000000-00004176.00000001.88577.003B3000.00000004.mdmp 00000000-00004552.00000000.78710.00290000.00000004.mdmp 00000000-00004552.00000001.79544.00309000.00000004.mdmp 00000000-00004552.00000001.79544.0036C000.00000004.mdmp "GISTRY\MACHINE\SOFTWARE\Classes\W@" in Source: 00000000-00001072.00000000.82930.002A0000.00000004.mdmp "HINE\SOFTWARE\Classes\Wow6432Node\C" in Source: 00000000-00001072.00000000.82930.002A0000.00000004.mdmp 00000000-00004176.00000000.88183.00300000.00000004.mdmp "SOFTWARE\Classes\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00001072.00000000.82930.002A0000.00000004.mdmp 00000000-00001072.00000001.83392.0030E000.00000004.mdmp 00000000-00004176.00000000.88183.00300000.00000004.mdmp 00000000-00004176.00000001.88577.00369000.00000004.mdmp 00000000-00004552.00000000.78710.00290000.00000004.mdmp 00000000-00004552.00000001.79544.00309000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00001072.00000000.82930.7EFE0000.00000002.mdmp 00000000-00001072.00000001.83392.7EFE0000.00000002.mdmp 00000000-00004176.00000000.88183.7EFE0000.00000002.mdmp 00000000-00004176.00000001.88577.7EFE0000.00000002.mdmp 00000000-00004552.00000000.78710.7EFE0000.00000002.mdmp 00000000-00004552.00000001.79544.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00001072.00000000.82930.7EFE0000.00000002.mdmp 00000000-00001072.00000001.83392.7EFE0000.00000002.mdmp 00000000-00004176.00000000.88183.7EFE0000.00000002.mdmp 00000000-00004176.00000001.88577.7EFE0000.00000002.mdmp 00000000-00004552.00000000.78710.7EFE0000.00000002.mdmp 00000000-00004552.00000001.79544.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00001072.00000000.82930.7EFE0000.00000002.mdmp 00000000-00001072.00000001.83392.7EFE0000.00000002.mdmp 00000000-00004176.00000000.88183.7EFE0000.00000002.mdmp 00000000-00004176.00000001.88577.7EFE0000.00000002.mdmp 00000000-00004552.00000000.78710.7EFE0000.00000002.mdmp 00000000-00004552.00000001.79544.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00001072.00000000.82930.7EFE0000.00000002.mdmp 00000000-00001072.00000001.83392.7EFE0000.00000002.mdmp 00000000-00004176.00000000.88183.7EFE0000.00000002.mdmp 00000000-00004176.00000001.88577.7EFE0000.00000002.mdmp 00000000-00004552.00000000.78710.7EFE0000.00000002.mdmp 00000000-00004552.00000001.79544.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00001072.00000000.82930.7EFE0000.00000002.mdmp 00000000-00001072.00000001.83392.7EFE0000.00000002.mdmp 00000000-00004176.00000000.88183.7EFE0000.00000002.mdmp 00000000-00004176.00000001.88577.7EFE0000.00000002.mdmp 00000000-00004552.00000000.78710.7EFE0000.00000002.mdmp 00000000-00004552.00000001.79544.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00001072.00000000.82930.7EFE0000.00000002.mdmp 00000000-00001072.00000001.83392.7EFE0000.00000002.mdmp 00000000-00004176.00000000.88183.7EFE0000.00000002.mdmp 00000000-00004176.00000001.88577.7EFE0000.00000002.mdmp 00000000-00004552.00000000.78710.7EFE0000.00000002.mdmp 00000000-00004552.00000001.79544.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00001072.00000000.82930.7EFE0000.00000002.mdmp 00000000-00001072.00000001.83392.7EFE0000.00000002.mdmp 00000000-00004176.00000000.88183.7EFE0000.00000002.mdmp 00000000-00004176.00000001.88577.7EFE0000.00000002.mdmp 00000000-00004552.00000000.78710.7EFE0000.00000002.mdmp 00000000-00004552.00000001.79544.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00001072.00000000.82930.7EFE0000.00000002.mdmp 00000000-00001072.00000001.83392.7EFE0000.00000002.mdmp 00000000-00004176.00000000.88183.7EFE0000.00000002.mdmp 00000000-00004176.00000001.88577.7EFE0000.00000002.mdmp 00000000-00004552.00000000.78710.7EFE0000.00000002.mdmp 00000000-00004552.00000001.79544.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00001072.00000000.82930.7EFE0000.00000002.mdmp 00000000-00001072.00000001.83392.7EFE0000.00000002.mdmp 00000000-00004176.00000000.88183.7EFE0000.00000002.mdmp 00000000-00004176.00000001.88577.7EFE0000.00000002.mdmp 00000000-00004552.00000000.78710.7EFE0000.00000002.mdmp 00000000-00004552.00000001.79544.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00001072.00000000.82930.7EFE0000.00000002.mdmp 00000000-00001072.00000001.83392.7EFE0000.00000002.mdmp 00000000-00004176.00000000.88183.7EFE0000.00000002.mdmp 00000000-00004176.00000001.88577.7EFE0000.00000002.mdmp 00000000-00004552.00000000.78710.7EFE0000.00000002.mdmp 00000000-00004552.00000001.79544.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00001072.00000000.82930.7EFE0000.00000002.mdmp 00000000-00001072.00000001.83392.7EFE0000.00000002.mdmp 00000000-00004176.00000000.88183.7EFE0000.00000002.mdmp 00000000-00004176.00000001.88577.7EFE0000.00000002.mdmp 00000000-00004552.00000000.78710.7EFE0000.00000002.mdmp 00000000-00004552.00000001.79544.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00001072.00000000.82930.7EFE0000.00000002.mdmp 00000000-00001072.00000001.83392.7EFE0000.00000002.mdmp 00000000-00004176.00000000.88183.7EFE0000.00000002.mdmp 00000000-00004176.00000001.88577.7EFE0000.00000002.mdmp 00000000-00004552.00000000.78710.7EFE0000.00000002.mdmp 00000000-00004552.00000001.79544.7EFE0000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp 00000000-00004176.00000000.88183.FF451000.00000020.mdmp 00000000-00004176.00000001.88577.FF451000.00000020.mdmp 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize" in Source: 00000000-00001072.00000001.83392.00131000.00000004.mdmp 00000000-00004176.00000001.88577.00121000.00000004.mdmp 00000000-00004552.00000001.79544.00130000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4799AA1D-FF5A-4804-9CF3-786A9E8616" in Source: 00000000-00001072.00000001.83392.00366000.00000004.mdmp "HINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4799AA1D-FF5A-4804-9CF3-786A9E861663}" in Source: 00000000-00001072.00000001.83392.00366000.00000004.mdmp "NE\SOFTWARE\Class" in Source: 00000000-00004176.00000000.88183.00300000.00000004.mdmp 00000000-00004176.00000001.88577.00350000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\C`" in Source: 00000000-00004176.00000000.88183.00300000.00000004.mdmp 00000000-00004176.00000001.88577.00350000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23345339-CDEB-4A60-8FEC-C925F151B8\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00004176.00000000.88183.00300000.00000004.mdmp 00000000-00004176.00000001.88577.00369000.00000004.mdmp "GISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00004176.00000000.88183.00300000.00000004.mdmp 00000000-00004552.00000000.78710.00290000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4799AA1D-FF5A-4804-9CF3-786A9E861663}" in Source: 00000000-00004176.00000001.88577.003C4000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WX" in Source: 00000000-00004552.00000000.78710.00290000.00000004.mdmp 00000000-00004552.00000001.79544.002FF000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78E25025-CBAE-48B2-B996-82F27F4729\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00004552.00000000.78710.00290000.00000004.mdmp 00000000-00004552.00000001.79544.00309000.00000004.mdmp "HINE\SOFTWARE\Classes\Wow6432Node\C," in Source: 00000000-00004552.00000000.78710.00290000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE33A527-42FE-43A4-AC5E-C1D059FC705F}" in Source: 00000000-00004552.00000001.79544.0036C000.00000004.mdmp "System\CurrentControlSet\Enum\" in Source: 00000000-00004552.00000001.79544.0089E000.00000004.mdmp "HKLM\System\CurrentControlSet\Services\vmusbmouse" in Source: 00000000-00004552.00000001.79544.0089E000.00000004.mdmp "e.hw.addreg_hklm\system\currentcontrolset\enum\" in Source: 00000000-00004552.00000001.79544.0146C000.00000004.mdmp "musbmouse.hw.addreg_hklm\system\currentcontrolset\enum\" in Source: 00000000-00004552.00000001.79544.0146C000.00000004.mdmp "m3d_softwaredevicesettings_common_hklm\system\currentcontrolset\control\class\{4d36e968-e325-11ce-bfc1-08002be10318}\" in Source: 00000000-00004552.00000001.79544.0146C000.00000004.mdmp "mware_installers_addreg_hklm\system\currentcontrolset\services\vm3dmp" in Source: 00000000-00004552.00000001.79544.0146C000.00000004.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parame" in Source: 00000000-00003700.00000000.66725.001EC000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003700.00000000.66725.00230000.00000004.mdmp 00000000-00003700.00000001.68648.00230000.00000004.mdmp 00000000-00003700.00000002.70572.00230000.00000004.mdmp 00000000-00003700.00000003.89547.00230000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00003700.00000000.66725.00230000.00000004.mdmp 00000000-00003700.00000001.68648.00230000.00000004.mdmp 00000000-00003700.00000002.70572.00230000.00000004.mdmp 00000000-00003700.00000003.89547.00230000.00000004.mdmp "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" in Source: 00000000-00003700.00000000.66725.005D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Wow6432Node\Policies\Microsoft\System\DNSClient" in Source: 00000000-00003700.00000000.66725.005D0000.00000004.mdmp2f:T691,"P.O 2023-03902" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "DISMHOST.EXE.6517EE89.bin" file has an entrypoint instructions - "sub rsp, 0x28,call 0x10000fcc0,add rsp, 0x28,jmp 0x10000f0b8,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],cmp rcx, qword ptr [rip + 0x6da9],jne 0x10000f40b,rol rcx, 0x10,test cx, 0xffff,jne 0x10000f407,ret 0,ror rcx, 0x10,jmp 0x10000fd7c,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x10], rbx,mov dword ptr [rsp + 0x18], r8d,mov qword ptr [rsp + 8], rcx,push rsi,push rdi,push r12,sub rsp, 0x40,"30:T4cc,"dism.log" has type "data"- [targetUID: 00000000-00003700] "Tar8315.tmp" has type "data"- Location: [%TEMP%\Tar8315.tmp]- [targetUID: 00000000-00003700] "DISMHOST.EXE.6517EE89.bin" has type "PE32+ executable (GUI) x86-64 for MS Windows"- [targetUID: 00000000-00003700] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00003700] "Cab8314.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab8314.tmp]- [targetUID: 00000000-00003700] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00003700] "DISMHOST.EXE.6513EB11.bin" has type "PE32+ executable (GUI) x86-64 for MS Windows"- [targetUID: 00000000-00003700] "DISMHOST.EXE.6510B910.bin" has type "PE32+ executable (GUI) x86-64 for MS Windows"- [targetUID: 00000000-00003700]31:T9f7,"P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "WINHTTPSETTINGS"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPV6DOMAIN"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")32:T554,"P.O2023-03902.exe" trying to touch file "C:\Windows\SYSTEM32\wow64.dll" "P.O2023-03902.exe" trying to touch file "C:\Windows\SYSTEM32\wow64win.dll" "P.O2023-03902.exe" trying to touch file "C:\Windows\SYSTEM32\wow64cpu.dll" "P.O2023-03902.exe" trying to touch file "C:\Windows\system32\wow64log.dll" "P.O2023-03902.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL" "P.O2023-03902.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "P.O2023-03902.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "P.O2023-03902.exe" trying to touch file "C:\FLTLIB.DLL" "P.O2023-03902.exe" trying to touch file "C:\Windows\SysWOW64\FLTLIB.DLL" "P.O2023-03902.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.DLL" "P.O2023-03902.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "P.O2023-03902.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "P.O2023-03902.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "P.O2023-03902.exe" trying to touch file "C:\Windows\SysWOW64\IMM32.DLL" "P.O2023-03902.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "P.O2023-03902.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "P.O2023-03902.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll"33:T615,"P.O2023-03902.exe" trying to access non-existent file "C:\Windows\system32\wow64log.dll" "P.O2023-03902.exe" trying to access non-existent file "C:\FLTLIB.DLL" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-2.dll" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-0.dll" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-quirks-l1-1-0.dll"34:T45d,"P.O2023-03902.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "P.O2023-03902.exe" trying to access non-existent file "C:\P.O2023-03902.exe.config" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Gqnnu\" "P.O2023-03902.exe" trying to access non-existent file "C:\P.O2023-03902.INI" "P.O2023-03902.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Net.Http\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Net.Http.INI" "P.O2023-03902.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}" "P.O2023-03902.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{6C12E41B-6773-4749-860C-009D730B17D7}" "P.O2023-03902.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "P.O2023-03902.exe" trying to access non-existent file "\Device\HarddiskVolume2\P.O2023-03902.EXE.CONFIG"35:T509,Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]Q0O0MAhttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0J!P-f+;z{]6mWXIY8Washington1Redmond1Microsoft" Heuristic match: "qu.ax" Pattern match: "C.JgU/0$" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]+Q0O0M+0Ahttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0U00" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0" Pattern match: "www.microsoft.com0" Heuristic match: "EXE;.BM" Heuristic match: "H;.MS" Heuristic match: "vmci.cat" Heuristic match: "vmmouse.cat" Heuristic match: "se.cat" Heuristic match: "vm3d.cat" Heuristic match: "AddReg=VMMouse.HW.Ad" Heuristic match: "vmusbmouse.cat" Heuristic match: "CatalogFile=vmmouse.cat" Heuristic match: "CatalogFile = vmci.cat" Heuristic match: "musbmouse.cat" Heuristic match: "mci.cat" Heuristic match: ":\Windows\System32\DriverStore\FileRepository\vmusbmouse.inf_amd64_neutral_589bb84d9702f3eb\vmusbmouse.cat" Heuristic match: "CatalogFile = vm3d.cat" Heuristic match: "CatalogFile=vmusbmouse.cat" Heuristic match: "PATHEXT=.COM;.EXE;.BAT;.CM" Heuristic match: ".Http.Tr" Pattern match: "Microsoft.NET/Framework/v4.0.30319/"36:T5078,Found URL "https://www.newtonsoft.com/jsonschema" - Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp") Found URL "https://www.nuget.org/packages/newtonsoft.json.bson" - Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003700.00000000.66725.02750000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003700.00000000.66725.02750000.00000004.mdmp") Found URL "https://qu.ax/naco.mp3:\windows\microsoft.net\assembly\gac_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll\windows\microsoft.net\assembly\gac_32\mscorlib\v4.0_4.0.0.0__b77a5:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll:\windows\microsoft.net\framework\v4.0.30319\nlssorting.dllystem.core," - Source: "00000000-00003700.00000001.68648.00990000.00000004.mdmp") Found URL "https://qu.ax/naco.mp3ystemcalrpctsvcscalrpctsvcs32.dllhttps://qu.ax/naco.mp3f2" - Source: "00000000-00003700.00000001.68648.00990000.00000004.mdmp") Found URL "https://www.newtonsoft.com/jsonschema" - Source: "00000000-00003700.00000001.68648.01042000.00000020.mdmp") Found URL "https://www.nuget.org/packages/newtonsoft.json.bson" - Source: "00000000-00003700.00000001.68648.01042000.00000020.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003700.00000001.68648.02750000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003700.00000001.68648.02750000.00000004.mdmp") Found URL "https://qu.ax/naco.mp3:\windows\microsoft.net\assembly\gac_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll\windows\microsoft.net\assembly\gac_32\mscorlib\v4.0_4.0.0.0__b77a5:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll:\windows\microsoft.net\framework\v4.0.30319\nlssorting.dllystem.core," - Source: "00000000-00003700.00000002.70572.00990000.00000004.mdmp") Found URL "https://qu.ax/naco.mp3ystemcalrpctsvcs32.dllhttps://qu.ax/naco.mp3f2" - Source: "00000000-00003700.00000002.70572.00990000.00000004.mdmp") Found URL "https://www.newtonsoft.com/jsonschema" - Source: "00000000-00003700.00000002.70572.01042000.00000020.mdmp") Found URL "https://www.nuget.org/packages/newtonsoft.json.bson" - Source: "00000000-00003700.00000002.70572.01042000.00000020.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003700.00000002.70572.02750000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003700.00000002.70572.02750000.00000004.mdmp") Found URL "https://qu.ax/naco.mp3evice\" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabgssapiha256microsoft" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o,zsh" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/6" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynslc/i9/-k" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,!!0ikf3" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa00_f3salt" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!f3hkf3kcf3e" - Source: "00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found URL "https://www.newtonsoft.com/jsonschema" - Source: "00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found URL "https://www.nuget.org/packages/newtonsoft.json.bson" - Source: "00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found URL "http://r3.o.lencr.org0" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://r3.i.lencr.org/0*.qu.axqu.ax05^o,ku@f" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0'http://x1.c.lencr.org/0" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=f3@<" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://www.microsoft.com0>3w07r3y]m8vf?jade0nul0?1$0" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0;l)" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootca.crl071http://crl4.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0s6" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcgeotrust" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcn;ajsuuuhhsmqdy32" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;globalsign" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9no)cf-?addtrust" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01,.2:/washington1redmond1microsoft" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://www.microsoft.com0>3w07r3y]m8vf?jade0nulm/.2j..23q.2op.2ts.2=r.2iu.2f3yjinternet1verisign," - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:tqg.," - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusverisign" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0addtrust" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?com1" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=/2;" - Source: "00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003700.00000003.89547.067F9000.00000004.mdmp") Found URL "http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003700.00000003.89547.067F9000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0;l)" - Source: "00000000-00003700.00000003.89547.067F9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0j!p-f+;z" - Source: "00000000-00003700.00000003.89547.067F9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003700.00000003.89547.06E60000.00000004.mdmp") Found URL "http://r3.o.lencr.org0" - Source: "00000000-00003700.00000003.89547.06E60000.00000004.mdmp") Found URL "http://r3.i.lenc*.qu.axqu.ax05^o,ku@f" - Source: "00000000-00003700.00000003.89547.06E60000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0'http://x1.c.lencr.org/0" - Source: "00000000-00003700.00000003.89547.06E60000.00000004.mdmp") Found URL "http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003700.00000003.89547.06E60000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0;l)" - Source: "00000000-00003700.00000003.89547.06E60000.00000004.mdmp") Found URL "http://r3.i.lencr.org/0*.qu.axqu.ax05^o,ku@f" - Source: "00000000-00003700.00000003.89547.06E60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0j!p-f+;z" - Source: "00000000-00003700.00000003.89547.06EC1000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003700.00000003.89547.06EC1000.00000004.mdmp") Found URL "http://www.microsoft.com0>3w07r3y]m8vf?jade0nul1.3.6.1.4.1.311.10.1230720001038z0" - Source: "00000000-00003700.00000003.89547.06EC1000.00000004.mdmp") Found URL "http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003700.00000003.89547.06EC1000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0;l)" - Source: "00000000-00003700.00000003.89547.06EC1000.00000004.mdmp")37:T427,Found string "+ncalrpc:[OLEA91C86D6EF0E4E4981829761A29F]" (Indicator: "ncalrpc"; Source: "00000000-00001072.00000000.82930.002A0000.00000004.mdmp") Found string "+ncalrpc:[OLEE0BE6C6C7CB64F20AA99BBAA909B]" (Indicator: "ncalrpc"; Source: "00000000-00001072.00000000.82930.002A0000.00000004.mdmp, 00000000-00001072.00000001.83392.0030E000.00000004.mdmp") Found string "+ncalrpc:[OLEBC7683CBB7D749AC9BEC261D6BB2]" (Indicator: "ncalrpc"; Source: "00000000-00004176.00000000.88183.00300000.00000004.mdmp") Found string "+ncalrpc:[OLEBA574A2772CB4B0298CBC92FE706]" (Indicator: "ncalrpc"; Source: "00000000-00004176.00000000.88183.00300000.00000004.mdmp, 00000000-00004176.00000001.88577.00369000.00000004.mdmp") Found string "+ncalrpc:[OLE647977EBDD8947DABFFBEF18BFF9]" (Indicator: "ncalrpc"; Source: "00000000-00004552.00000000.78710.00290000.00000004.mdmp, 00000000-00004552.00000001.79544.002E0000.00000004.mdmp") Found string "+ncalrpc:[OLE5AC60FF495A04529A4F745F1D093]" (Indicator: "ncalrpc"; Source: "00000000-00004552.00000000.78710.00290000.00000004.mdmp")38:T9e4,"P.O2023-03902.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00003700) "P.O2023-03902.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003700)39:T1562,Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "P.O 2023-03902") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; File: "P.O 2023-03902") Found string "CryptoStream" (Indicator: "cryptostream"; File: "P.O 2023-03902") Found string "FromBase64String" (Indicator: "base64"; File: "P.O 2023-03902") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "P.O 2023-03902") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "P.O 2023-03902") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "P.O 2023-03902") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "P.O 2023-03902") Found string "FromBase64CharArray" (Indicator: "base64"; File: "P.O 2023-03902") Found string "ToBase64CharArray" (Indicator: "base64"; File: "P.O 2023-03902") Found string ", System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; File: "P.O 2023-03902") Found string "Rijndael" (Indicator: "rijndael"; File: "P.O 2023-03902") Found string "System.Security.Cryptography." (Indicator: "System.Security.Cryptography"; File: "P.O 2023-03902") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003700.00000000.66725.00990000.00000004.mdmp, 00000000-00003700.00000001.68648.00990000.00000004.mdmp, 00000000-00003700.00000002.70572.00990000.00000004.mdmp, 00000000-00003700.00000003.89547.00990000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003700.00000000.66725.00990000.00000004.mdmp, 00000000-00003700.00000000.66725.02750000.00000004.mdmp, 00000000-00003700.00000001.68648.00990000.00000004.mdmp, 00000000-00003700.00000001.68648.02750000.00000004.mdmp, 00000000-00003700.00000002.70572.00990000.00000004.mdmp, 00000000-00003700.00000002.70572.02750000.00000004.mdmp, 00000000-00003700.00000003.89547.00990000.00000004.mdmp, 00000000-00003700.00000003.89547.06740000.00000004.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp") Found string "ToBase64CharArray" (Indicator: "base64"; Source: "00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp")3a:T6b0,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp")3b:T1b65,Found string "\Device\HarddiskVolume2\Windows\Temp\0654B62B-7F7F-4934-91E0-35DC0DCE2F62\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00001072.00000000.82930.002A0000.00000004.mdmp, 00000000-00001072.00000001.83392.002A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001072.00000001.83392.0030E000.00000004.mdmp, 00000000-00004176.00000001.88577.00369000.00000004.mdmp, 00000000-00004552.00000001.79544.002E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001072.00000001.83392.0030E000.00000004.mdmp, 00000000-00004176.00000001.88577.00369000.00000004.mdmp, 00000000-00004552.00000001.79544.00309000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_neutral_3634f6f3865df877\vmci.inf" (Indicator: "system32\drivers"; Source: "00000000-00001072.00000001.83392.0030E000.00000004.mdmp, 00000000-00001072.00000001.83392.00366000.00000004.mdmp, 00000000-00004176.00000001.88577.00300000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001072.00000001.83392.00356000.00000004.mdmp, 00000000-00004176.00000001.88577.003B3000.00000004.mdmp, 00000000-00004552.00000001.79544.00309000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001072.00000001.83392.00356000.00000004.mdmp, 00000000-00004176.00000001.88577.003B3000.00000004.mdmp, 00000000-00004552.00000001.79544.00309000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001072.00000001.83392.00356000.00000004.mdmp, 00000000-00004176.00000001.88577.003B3000.00000004.mdmp, 00000000-00004552.00000001.79544.00309000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001072.00000001.83392.00356000.00000004.mdmp, 00000000-00004176.00000001.88577.003B3000.00000004.mdmp, 00000000-00004552.00000001.79544.00309000.00000004.mdmp") Found string ":\Windows\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001072.00000001.83392.0035F000.00000004.mdmp, 00000000-00004176.00000001.88577.003BF000.00000004.mdmp, 00000000-00004552.00000001.79544.00309000.00000004.mdmp, 00000000-00004552.00000001.79544.0036C000.00000004.mdmp") Found string "PID=1072 Failed opening driver package for x86: INF Name='C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_neutral_3634f6f3865df877\vmci.inf' - CDriverPackage::OpenDmiDriverPackages(hr:0x80070003)" (Indicator: "system32\drivers"; Source: "00000000-00001072.00000001.83392.00366000.00000004.mdmp") Found string "vmci.DriverFiles.x64 = 12 ; %%SystemRoot%%\System32\drivers" (Indicator: "system32\drivers"; Source: "00000000-00001072.00000001.83392.00366000.00000004.mdmp, 00000000-00004552.00000001.79544.0036C000.00000004.mdmp") Found string "HKR, , EventMessageFile, 0x00020000, "%%SystemRoot%%\System32\drivers\vmci.sys"" (Indicator: "\drivers\"; Source: "00000000-00001072.00000001.83392.00366000.00000004.mdmp, 00000000-00004176.00000001.88577.003C4000.00000004.mdmp") Found string "HKR, , EventMessageFile, 0x00020000, "%%SystemRoot%%\System32\drivers\vmci.sys"" (Indicator: "system32\drivers"; Source: "00000000-00001072.00000001.83392.00366000.00000004.mdmp, 00000000-00004176.00000001.88577.003C4000.00000004.mdmp") Found string "2\drivers\vmci.sys" (Indicator: "\drivers\"; Source: "00000000-00001072.00000001.83392.00366000.00000004.mdmp, 00000000-00004176.00000001.88577.003C4000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Temp\18AF95EC-8629-4E53-AC04-7D905CEC9F45\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00004176.00000000.88183.00300000.00000004.mdmp, 00000000-00004176.00000001.88577.00300000.00000004.mdmp") Found string "PID=4176 Failed opening driver package for x86: INF Name='C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_neutral_3634f6f3865df877\vmci.inf' - CDriverPackage::OpenDmiDriverPackages(hr:0x80070003)" (Indicator: "system32\drivers"; Source: "00000000-00004176.00000001.88577.003C4000.00000004.mdmp") Found string "'C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_neutral_3634f6f3865df877\vmci.inf' - CDriverPackage::OpenDmiDriverPackages(hr:0x80070003)" (Indicator: "system32\drivers"; Source: "00000000-00004176.00000001.88577.003C4000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_neutral_3634f6f3865df877" (Indicator: "system32\drivers"; Source: "00000000-00004176.00000001.88577.003C4000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Temp\509C17EB-EFE3-4CCD-A1DE-B4CFD594A094\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00004552.00000000.78710.00290000.00000004.mdmp, 00000000-00004552.00000001.79544.00290000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vm3d.inf_amd64_neutral_92fb33e16621b138\vm3d.inf" (Indicator: "system32\drivers"; Source: "00000000-00004552.00000001.79544.00290000.00000004.mdmp, 00000000-00004552.00000001.79544.00354000.00000004.mdmp, 00000000-00004552.00000001.79544.00366000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vmmouse.inf_amd64_neutral_550f4ea2f87d6cef\vmmouse.inf" (Indicator: "system32\drivers"; Source: "00000000-00004552.00000001.79544.00290000.00000004.mdmp, 00000000-00004552.00000001.79544.00354000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vmusbmouse.inf_amd64_neutral_589bb84d9702f3eb\vmusbmouse.inf" (Indicator: "system32\drivers"; Source: "00000000-00004552.00000001.79544.00290000.00000004.mdmp, 00000000-00004552.00000001.79544.00354000.00000004.mdmp, 00000000-00004552.00000001.79544.00359000.00000004.mdmp, 00000000-00004552.00000001.79544.00366000.00000004.mdmp, 00000000-00004552.00000001.79544.0036C000.00000004.mdmp, 00000000-00004552.00000001.79544.00386000.00000004.mdmp, 00000000-00004552.00000001.79544.0146C000.00000004.mdmp") Found string "$WC:\Windows\System32\DriverStore\FileRepository\vmusbmouse.inf_amd64_neutral_589bb84d9702f3eb\vmusbmouse.inf" (Indicator: "system32\drivers"; Source: "00000000-00004552.00000001.79544.00309000.00000004.mdmp") Found string "PID=4552 Driver C:\Windows\System32\DriverStore\FileRepository\vmmouse.inf_amd64_neutral_550f4ea2f87d6cef\vmmouse.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "system32\drivers"; Source: "00000000-00004552.00000001.79544.00309000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00004552.00000001.79544.00309000.00000004.mdmp") file/memory contains long string with (Indicator: "system32\drivers"; Source: "00000000-00004552.00000001.79544.00309000.00000004.mdmp")3c:T21e6,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "IsValidSecurityDescriptor" (Indicator: "IsValidSecurityDescriptor"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp")3d:Td56,Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "GetSecurityDescriptorControl" which can "Retrieves a security descriptor control and revision information" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "GetSecurityDescriptorGroup" which can "Retrieves the primary group information from a security descriptor" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "GetSecurityDescriptorOwner" which can "Retrieves the owner information from a security descriptor" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "GetSecurityDescriptorSacl" which can "Retrieves a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "GetSidLengthRequired" which can "Returns the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "IsValidSecurityDescriptor" which can "Determines whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "IsValidSid" which can "Validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "MakeAbsoluteSD" which can "Creates a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "SetSecurityDescriptorGroup" which can "Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6517EE89.bin] Observed import api "SetSecurityDescriptorOwner" which can "Sets the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6517EE89.bin]3e:T8b2,"P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPV6DOMAIN"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "P.O2023-03902.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "")3f:Ta3a,"P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "P.O2023-03902.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")40:T7bb,"P.O2023-03902.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\16E\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "P.O2023-03902.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\P_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "00000000") "P.O2023-03902.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\P_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "P.O2023-03902.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\P_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "P.O2023-03902.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\P_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "P.O2023-03902.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\P_RASAPI32"; Key: "MAXFILESIZE"; Value: "00001000") "P.O2023-03902.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\P_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "P.O2023-03902.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\P_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "00000000") "P.O2023-03902.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\P_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "00000000") "P.O2023-03902.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\P_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF") "P.O2023-03902.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\P_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") "P.O2023-03902.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\P_RASMANCS"; Key: "MAXFILESIZE"; Value: "00001000") "P.O2023-03902.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\P_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")41:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a82af7127b9a6eb4a85f49a8a86ff09e155dfec3fa0d5387726c1c993a4cd947","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790750995968,"unified_at":"2026-09-30T06:49:55.968Z","metadata":{"hashes":{"sha256":"a82af7127b9a6eb4a85f49a8a86ff09e155dfec3fa0d5387726c1c993a4cd947","sha1":"aabc0c9de290834f1b021ebd757d7588e082cc59","md5":"2fa9acd0775d8e6e767d74227759d812","sha512":"0eaa8d70942288d53638e9ba0a0dcb42baa3bb5daa2a57983b243f371788d89a67cdcc8d86672ff217975089b1ae69ae4a98eaf312ccc424d084388ca0dfe896","ssdeep":"24576:eu7d3LpCztAG48YQcHaakCf0wVrFhQd5kcqAI:bLr8nurFhQdC","ssdeep_chunks":["24576:eu7d3Lp","24576:u7d3LpC","24576:7d3LpCz","24576:d3LpCzt","24576:3LpCztA","24576:LpCztAG","24576:pCztAG4","24576:CztAG48","24576:ztAG48Y","24576:tAG48YQ","24576:AG48YQc","24576:G48YQcH","24576:48YQcHa","24576:8YQcHaa","24576:YQcHaak","24576:QcHaakC","24576:cHaakCf","24576:HaakCf0","24576:aakCf0w","24576:akCf0wV","24576:kCf0wVr","24576:Cf0wVrF","24576:f0wVrFh","24576:0wVrFhQ","24576:wVrFhQd","24576:VrFhQd5","24576:rFhQd5k","24576:FhQd5kc","24576:hQd5kcq","24576:Qd5kcqA","24576:d5kcqAI","49152:eu7d3Lp","49152:u7d3LpC","49152:7d3LpCz","49152:d3LpCzt","49152:3LpCztA","49152:LpCztAG","49152:pCztAG4","49152:CztAG48","49152:ztAG48Y","49152:tAG48YQ","49152:AG48YQc","49152:G48YQcH","49152:48YQcHa","49152:8YQcHaa","49152:YQcHaak","49152:QcHaakC","49152:cHaakCf","49152:HaakCf0","49152:aakCf0w","49152:akCf0wV","49152:kCf0wVr","49152:Cf0wVrF","49152:f0wVrFh","49152:0wVrFhQ","49152:wVrFhQd","49152:VrFhQd5","49152:rFhQd5k","49152:FhQd5kc","49152:hQd5kcq","49152:Qd5kcqA","49152:d5kcqAI","24576:bLr8nur","24576:Lr8nurF","24576:r8nurFh","24576:8nurFhQ","24576:nurFhQd","24576:urFhQdC"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"P.O 2023-03902.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1524224,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1695302411000,"last_seen":1695314647000,"last_multi_scan":1695314647000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":54},"sandbox_signatures":{"informative_count":110,"suspicious_count":19,"malicious_count":3,"total":132},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1323343","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:TrojanDownloader/MSIL.Agent.y","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.GJP.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_90%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to encrypt/decrypt data using TripleDES"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Writes registry keys"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetDeviceRegistryPropertyA\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00003700.00000000.66725.003CC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$26","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$27","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor rax\n rsp in Stream UID: 9701-27-00000001000087B0\n Assembly shows XOR instruction xor eax\n esp in Stream UID: 9701-27-00000001000087B0\n Assembly shows XOR instruction xor rcx\n rsp in Stream UID: 9701-27-00000001000087B0\n Assembly shows XOR instruction xor ecx\n esp in Stream UID: 9701-27-00000001000087B0\n Assembly shows XOR instruction xor rax\n rsp in Stream UID: 9701-7-00000001000099F4\n Assembly shows XOR instruction xor eax\n esp in Stream UID: 9701-7-00000001000099F4\n Assembly shows XOR instruction xor rcx\n rsp in Stream UID: 9701-7-00000001000099F4\n Assembly shows XOR instruction xor ecx\n esp in Stream UID: 9701-7-00000001000099F4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"P.O 2023-03902\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/decrypt data using TripleDES","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"P.O 2023-03902\")\n Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-486","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt data\n Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to encrypt/decrypt data using TripleDES\n Matched sigs: Contains ability to decrypt/decode data\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"P.O2023-03902.exe\" called \"IsWow64Process\" with parameter \"3700\" - (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"P.O2023-03902.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"P.O2023-03902.exe\" called \"GetVersionExA\" (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"P.O2023-03902.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetDeviceRegistryPropertyA\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"00000000-00003700.00000000.66725.003CC000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00003700.00000000.66725.00990000.00000004.mdmp\n 00000000-00003700.00000001.68648.00990000.00000004.mdmp\n 00000000-00003700.00000002.70572.00990000.00000004.mdmp\n 00000000-00003700.00000003.89547.00990000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"P.O2023-03902.exe\" queries volume information of \"C:\\P.O2023-03902.exe\" at 00000000-00003700-00000046-1995842\n \"P.O2023-03902.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Net.Http\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Net.Http.dll\" at 00000000-00003700-00000046-3625528\n \"P.O2023-03902.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Net.Http\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Net.Http.dll\" at 00000000-00003700-00000046-3632243","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"P.O2023-03902.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"P.O2023-03902.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"P.O2023-03902.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003700)\n \"P.O2023-03902.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"92.118.112.119:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessor\" (Indicator: \"CreateProcess\"; File: \"P.O 2023-03902\")\n Found reference to API \"CreateProcessor\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003700.00000000.66725.01042000.00000020.mdmp, 00000000-00003700.00000001.68648.01042000.00000020.mdmp, 00000000-00003700.00000002.70572.01042000.00000020.mdmp, 00000000-00003700.00000003.89547.01042000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 9701-1-000000010000F3CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"Global\\CLR_PerfMon_WrapMutex\"\n \"RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Tar8315.tmp\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"DISMHOST.EXE.6517EE89.bin\" as clean (type is \"PE32+ executable (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"DISMHOST.EXE.6513EB11.bin\" as clean (type is \"PE32+ executable (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"DISMHOST.EXE.6510B910.bin\" as clean (type is \"PE32+ executable (GUI) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"P.O 2023-03902\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"P.O2023-03902.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 702D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"P.O2023-03902.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73AB0000\n \"P.O2023-03902.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73440000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"P.O2023-03902.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 70F30000\n \"P.O2023-03902.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 716E0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"P.O2023-03902.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76A30000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"P.O 2023-03902\" was detected as \".NET\" and name: \"Library\"\n \"P.O 2023-03902\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"DISMHOST.EXE.6517EE89.bin\" was detected as \".NET\" and name: \"Library\"\n \"DISMHOST.EXE.6517EE89.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"P.O 2023-03902\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"DISMHOST.EXE.6517EE89.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"P.O 2023-03902\" has an executable section named \".text\"\n \"DISMHOST.EXE.6517EE89.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"DISMHOST.EXE.6517EE89.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2f","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x173800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x173614\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"DISMHOST.EXE.6517EE89.bin\" has high imagebase \"0x100000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"qu.ax\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"P.O2023-03902.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"P.O2023-03902.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"P.O2023-03902.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"P.O2023-03902.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00003700-00000C28-1119055001]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"P.O 2023-03902\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"P.O2023-03902.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab8314.tmp\"\n \"P.O2023-03902.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar8315.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"P.O2023-03902.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$30","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"Tar8315.tmp\" has type \"data\" - Location: [%TEMP%\\Tar8315.tmp]\n \"Cab8314.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\" - Location: [%TEMP%\\Cab8314.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"\"P.O2023-03902.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\MSASN1\"; Key: \"\"; Value: \"\")\n \"P.O2023-03902.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CRYPTOGRAPHY\\PROVIDERS\"; Key: \"\"; Value: \"\")\n \"P.O2023-03902.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CRYPTOGRAPHY\\CONFIGURATION\"; Key: \"\"; Value: \"\")\n \"P.O2023-03902.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\\FIPSALGORITHMPOLICY\"; Key: \"\"; Value: \"\")\n \"P.O2023-03902.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"\"; Value: \"\")\n \"P.O2023-03902.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\POLICIES\\MICROSOFT\\CRYPTOGRAPHY\\CONFIGURATION\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"P.O2023-03902.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\dnsapi.dll\" (UID: 3700)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"P.O2023-03902.exe\" called \"NtQueueApcThread\" (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"P.O2023-03902.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \"P.O2023-03902.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux\"\n \"P.O2023-03902.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\0b2f69b43a576b9edcc807a30872bd91\\system.ni.dll.aux\"\n \"P.O2023-03902.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll.aux\"\n \"P.O2023-03902.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll.aux\"\n \"P.O2023-03902.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.net.http\\f437762e2fc90826e3f326b71ffc659c\\system.net.http.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Tries to sleep for a long time (more than two minutes)\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect presence of virtual environment (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"P.O2023-03902.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"P.O2023-03902.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"P.O2023-03902.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"P.O2023-03902.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \"P.O2023-03902.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"P.O2023-03902.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"P.O2023-03902.exe\" writes file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"P.O2023-03902.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\cab8314.tmp\"\n \"P.O2023-03902.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\tar8315.tmp\"\n \"P.O2023-03902.exe\" writes file \"%temp%\\tar8315.tmp\"\n \"P.O2023-03902.exe\" writes file \"%localappdata%\\ow\\microsoft\\cryptneturlcache\\content\\77ec63bda74bd0d0e0426dc8f8008506\"\n \"P.O2023-03902.exe\" writes file \"%temp%\\cab8314.tmp\"\n \"P.O2023-03902.exe\" writes file \"%localappdata%\\ow\\microsoft\\cryptneturlcache\\metadata\\77ec63bda74bd0d0e0426dc8f8008506\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"P.O2023-03902.exe\" called \"WinHttpSendRequest\" (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"P.O2023-03902.exe\" called \"WinHttpReceiveResponse\" (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$35","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$36","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"92.118.112.119\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$37","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"P.O2023-03902.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"P.O2023-03902.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"40257751170,4548,3112,,FindFirstFileW,kernel32.dll,\"00:20:39.942\",RX=0,PX=0\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004552.00000001.79544.0036C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"11357116023,3784,3024,,RtlGetVersion,NTDLL.dll,\"00:21:33.529\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001072.00000000.82930.002A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwordFormat=h\" (Indicator: \"password\"; Source: \"00000000-00003700.00000000.66725.00990000.00000004.mdmp, 00000000-00003700.00000001.68648.00990000.00000004.mdmp, 00000000-00003700.00000002.70572.00990000.00000004.mdmp, 00000000-00003700.00000003.89547.00990000.00000004.mdmp\")\n Found string \"passwordAttem\" (Indicator: \"password\"; Source: \"00000000-00003700.00000000.66725.00990000.00000004.mdmp, 00000000-00003700.00000001.68648.00990000.00000004.mdmp, 00000000-00003700.00000002.70572.00990000.00000004.mdmp, 00000000-00003700.00000003.89547.00990000.00000004.mdmp\")\n Found string \"passwordFormat=\"Hashed\" (Indicator: \"password\"; Source: \"00000000-00003700.00000000.66725.00990000.00000004.mdmp\n 00000000-00003700.00000001.68648.00990000.00000004.mdmp\n 00000000-00003700.00000002.70572.00990000.00000004.mdmp\n 00000000-00003700.00000003.89547.00990000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"P.O2023-03902.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003700)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001072.00000000.82930.FFCA1000.00000020.mdmp, 00000000-00001072.00000001.83392.FFCA1000.00000020.mdmp, 00000000-00004176.00000000.88183.FF451000.00000020.mdmp, 00000000-00004176.00000001.88577.FF451000.00000020.mdmp, 00000000-00004552.00000000.78710.FF6C1000.00000020.mdmp, 00000000-00004552.00000001.79544.FF6C1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"P.O2023-03902.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$3d","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"P.O2023-03902.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00003700.00000000.66725.005D0000.00000004.mdmp, 00000000-00003700.00000000.66725.02750000.00000004.mdmp, 00000000-00003700.00000000.66725.03750000.00000004.mdmp, 00000000-00003700.00000001.68648.005D0000.00000004.mdmp, 00000000-00003700.00000001.68648.02750000.00000004.mdmp, 00000000-00003700.00000001.68648.03750000.00000004.mdmp, 00000000-00003700.00000002.70572.005D0000.00000004.mdmp, 00000000-00003700.00000002.70572.02750000.00000004.mdmp, 00000000-00003700.00000002.70572.03750000.00000004.mdmp, 00000000-00003700.00000003.89547.005D0000.00000004.mdmp, 00000000-00003700.00000003.89547.03750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00003700]\n Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00003700]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"P.O 2023-03902\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"P.O2023-03902.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"P.O2023-03902.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"P.O2023-03902.exe\" at 00000000-00003700-00000033-3244104","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"P.O2023-03902.exe\" queried SystemProcessInformation at 00000000-00003700-00000033-2644454 [PID: 3700]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".reloc with unusual entropies 0.101910425663","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 9701-1-000000010000F3CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"P.O2023-03902.exe\" (Thread ID: 4460) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"P.O2023-03902.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"5/90 reputation engines marked \"http://qu.ax\" as malicious (5% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"30/71 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DISMHOST.EXE.6517EE89.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: 00000000-00003700]\n \"DISMHOST.EXE.6513EB11.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: 00000000-00003700]\n \"DISMHOST.EXE.6510B910.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"- [targetUID: 00000000-00003700]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"192.168.241.210\"\n Potential IP \"12.5.12.0\" found in string \"DriverVer=10/27/2021, 12.5.12.0\"\n Potential IP \"9.8.18.0\" found in string \"DriverVer = 10/29/2021, 9.8.18.0\"\n \"2.5.12.0\"\n Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\"\", Potential IP \"4.0.0.0\" found in string \"4.0.0.0\n Cul\", Potential IP \"4.0.0.0\" found in string \"ersion=4.0.0.0\n Culture=neutral\n PublicKeyToken=b77a5c561934e0\", \"8.8.8.8\", \"255.255.255.255\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 92.118.112.119 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00003700.00000000.66725.005D0000.00000004.mdmp, 00000000-00003700.00000000.66725.02750000.00000004.mdmp, 00000000-00003700.00000000.66725.03750000.00000004.mdmp, 00000000-00003700.00000001.68648.005D0000.00000004.mdmp, 00000000-00003700.00000001.68648.02750000.00000004.mdmp, 00000000-00003700.00000001.68648.03750000.00000004.mdmp, 00000000-00003700.00000002.70572.005D0000.00000004.mdmp, 00000000-00003700.00000002.70572.02750000.00000004.mdmp, 00000000-00003700.00000002.70572.03750000.00000004.mdmp, 00000000-00003700.00000003.89547.005D0000.00000004.mdmp, 00000000-00003700.00000003.89547.03750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"P.O2023-03902.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab8314.tmp\" for deletion\n \"P.O2023-03902.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar8315.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"P.O2023-03902.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab8314.tmp\" with delete access\n \"P.O2023-03902.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar8315.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"DISMHOST.EXE.6517EE89.bin\" claimed CRC 141269 while the actual is CRC 1560331","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetSecurityDescriptorDacl\n OutputDebugStringW\n GetModuleFileNameW\n GetVersionExW\n OutputDebugStringA\n VirtualProtect\n GetVersionExA\n GetFileAttributesW\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetTickCount\n MapViewOfFile\n GetProcAddress\n CreateFileMappingW\n CreateThread\n LoadLibraryW\n GetSystemDirectoryW\n FindResourceExW\n GetModuleHandleW\n TerminateProcess\n GetModuleHandleExW\n CreateFileW\n Sleep","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"P.O2023-03902.exe\" wrote bytes \"0efc847781ed8377ae868277c6e08177effd84772d168377c0fc8077da8f8b7760148577478d8277a8e281776089827700000000ad3757768b2d5776b641577600000000\" to virtual address \"0x73A21000\" (part of module \"WSHIP6.DLL\")\n \"P.O2023-03902.exe\" wrote bytes \"8082e873\" to virtual address \"0x737B4028\" (part of module \"WEBIO.DLL\")\n \"P.O2023-03902.exe\" wrote bytes \"db4dec7300000000\" to virtual address \"0x01042000\" (part of module \"P.O2023-03902.EXE\")\n \"P.O2023-03902.exe\" wrote bytes \"c449a238\" to virtual address \"0x716EF798\" (part of module \"CLR.DLL\")\n \"P.O2023-03902.exe\" wrote bytes \"7111d4007a3bd300ab8b02007f950200fc8c0200729602006cc805001ecdd0007d26d000\" to virtual address \"0x76B307E4\" (part of module \"USER32.DLL\")\n \"P.O2023-03902.exe\" wrote bytes \"7d07857781ed8377ae868277c6e08177effd84772d16837760148577478d8277a8e281776089827700000000ad3757768b2d5776b641577600000000\" to virtual address \"0x73AA1000\" (part of module \"WSHTCPIP.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"30/71 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":80,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":7,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"650c72d779e0067ae00a9286","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"AGEN.1323343","contacted_countries":["RUS"],"submit_name":"P.O 2023-03902.exe","analysis_start_time":"2023-09-21T16:44:07+00:00","indicators_count":{"informative":110,"suspicious":38,"malicious":3},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"92.118.112.119","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]}],"dns_resolutions":[{"domain":"qu.ax","address":"92.118.112.119","ttl":300,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}],"processes":[{"pid":3700,"ppid":0,"name":"P.O2023-03902.exe","command_line":"","sha256":"a82af7127b9a6eb4a85f49a8a86ff09e155dfec3fa0d5387726c1c993a4cd947","normalized_path":"C:\\P.O2023-03902.exe","uid":"00000000-00003700","icon":"$41"}],"all_imported_dlls":["mscoreei.dll","ucrtbase_clr0400.dll","rsaenh.dll","System.Configuration.ni.dll","rtutils.dll","winhttp.dll","user32.dll","lpk.dll","usp10.dll","imm32.dll","dhcpcsvc.dll","msasn1.dll","mscorlib.ni.dll","psapi.dll","mswsock.dll","cabinet.dll","devrtl.dll","wow64win.dll","advapi32.dll","ole32.dll","nlssorting.dll","dhcpcsvc6.dll","VxSSL32.dll","shell32.dll","System.Xml.ni.dll","rasman.dll","webio.dll","FWPUCLNT.DLL","Wldap32.dll","sechost.dll","ws2_32.dll","nsi.dll","fltLib.dll","clr.dll","bcrypt.dll","winnsi.dll","wship6.dll","cfgmgr32.dll","schannel.dll","wow64.dll","wow64cpu.dll","shlwapi.dll","version.dll","WSHTCPIP.DLL","secur32.dll","userenv.dll","cryptnet.dll","ntdll.dll","cryptbase.dll","api-ms-win-core-synch-l1-2-0.dll","vcruntime140_clr0400.dll","System.ni.dll","credssp.dll","rasadhlp.dll","SensApi.dll","kernel32.dll","msctf.dll","System.Net.Http.dll","bcryptprimitives.dll","gpapi.dll","setupapi.dll","KernelBase.dll","clrjit.dll","System.Core.ni.dll","profapi.dll","msvcrt.dll","IPHLPAPI.DLL","mscoree.dll","dnsapi.dll","rasapi32.dll","mscorrc.dll","devobj.dll","rpcrt4.dll","sspicli.dll","gdi32.dll","oleaut32.dll","cryptsp.dll","crypt32.dll","api-ms-win-core-xstate-l2-1-0.dll","ncrypt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Tar8315.tmp","sha256":"bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"name":"DISMHOST.EXE.6517EE89.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"name":"DISMHOST.EXE.6513EB11.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"name":"DISMHOST.EXE.6510B910.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"75af0f95fffe7ceb2c8fcb80a4555c86ea0902df6731c15c10a9e6c0cb314664","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"name":"Cab8314.tmp","sha256":"6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"name":"dism.log","sha256":"3df900e2290ba9a6a67f544af375f02b9c51b1ae9679555a658d19d87542b8e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{6C12E41B-6773-4749-860C-009D730B17D7}","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"650c72d779e0067ae00a9286"}]}]}},"report_ids":{"sandbox_job_ids":["650c72d779e0067ae00a9286"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_90% Sample a82af7127b9a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a82af7127b9a…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 6/28 AV engines flagged this file. 3 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a82af7127b9a6eb4a85f49a8a86ff09e155dfec3fa0d5387726c1c993a4cd947"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_90% Sample a82af7127b9a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a82af7127b9a…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 6/28 AV engines flagged this file. 3 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a82af7127b9a6eb4a85f49a8a86ff09e155dfec3fa0d5387726c1c993a4cd947"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_90% Sample a82af7127b9a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a82af7127b9a…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 6/28 AV engines flagged this file. 3 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]]