34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 75:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4aa,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.Downloader Sample a92f2d3dc8ca… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a92f2d3dc8ca…. Malware family: IL:Trojan.Downloader. Threat score 100/100. 15/28 AV engines flagged this file. 15 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","keywords":["Malicious","IL:Trojan.Downloader","malware analysis","sandbox report","threat intelligence","a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af"],"about":{"@type":"SoftwareApplication","name":"OurNew.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.Downloader","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":15,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Tf11,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp, 00000000-00007576.00000001.193168.70007000.00000004.mdmp, 00000000-00007576.00000001.193168.72362000.00000004.mdmp, 00000000-00007576.00000001.193168.7246F000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\481f1a5c0959042363de5c765867b51d\System.Management.Automation.ni.dll" (Source: "00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp, 00000000-00007576.00000001.193168.70007000.00000004.mdmp, 00000000-00007576.00000001.193168.72362000.00000004.mdmp, 00000000-00007576.00000001.193168.7246F000.00000004.mdmp") Found string "ile:///C:/WINDOWS/system32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.DLL" (Source: "00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp, 00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found string "ile:///C:/WINDOWS/system32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.EXE" (Source: "00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp, 00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found string "??\C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp") Found string "??\C:\WINDOWS\system32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources\System.Management.Automation.resources.dll" (Source: "00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp, 00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp, 00000000-00007576.00000001.193168.70007000.00000004.mdmp") Found string "ile:///C:/WINDOWS/system32/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources.DLL" (Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found string "System.Management.Automation.resources.DLL" (Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found string "System.Management.Automation.resources.EXE" (Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found string ":\WINDOWS\system32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.EXE" (Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found string "??\C:\WINDOWS\assembly\GAC_MSIL\System.Management.Automation.resources\3.0.0.0_en-US_31bf3856ad364e35\System.Management.Automation.resources.dll" (Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found string "??\C:\WINDOWS\assembly\GAC\System.Management.Automation.resources\3.0.0.0_en-US_31bf3856ad364e35\System.Management.Automation.resources.dll" (Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found string "??\C:\WINDOWS\assembly\GAC_64\System.Management.Automation.resources\3.0.0.0_en-US_31bf3856ad364e35\System.Management.Automation.resources.dll" (Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found string "IL\System.Management.Automation\v4.0_3.0" (Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found string "rosoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad" (Source: "00000000-00007576.00000001.193168.72433000.00000004.mdmp")37:T486,Found string "System.IO.Compression.ZipFile" (Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found string "system.io.compression" (Source: "00000000-00007576.00000001.193168.F8B60000.00000004.mdmp, 00000000-00007576.00000001.193168.F8B80000.00000004.mdmp") Found string "compressionmode" (Source: "00000000-00007576.00000001.193168.F8B60000.00000004.mdmp") Found string "decompressionmethods" (Source: "00000000-00007576.00000001.193168.F8B60000.00000004.mdmp") Found string "compressionlevel" (Source: "00000000-00007576.00000001.193168.F8B60000.00000004.mdmp") Found string "compressionstrategy" (Source: "00000000-00007576.00000001.193168.F8B60000.00000004.mdmp") Found string "compressionmethod" (Source: "00000000-00007576.00000001.193168.F8B60000.00000004.mdmp") Found string "compressiontracingswitchlevel" (Source: "00000000-00007576.00000001.193168.F8B80000.00000004.mdmp") Found string "compressiontracingswitch" (Source: "00000000-00007576.00000001.193168.F8B80000.00000004.mdmp") Found string "feature_servicing_cjkextensionfoldercompressionerror" (Source: "00000000-00007576.00000001.193168.F8BA0000.00000004.mdmp")38:T82f,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001168.00000000.189609.009F4000.00000002.mdmp, 00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp")39:T585,Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp")3a:T4ab,Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp")3b:T428,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00008224-00000BC0-1799059522") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00008224-00000CC3-1877733530") Found reference to "nvalidHashAlgorithm" (Indicator: "HashAlgorithm"; File: "AMSI") Found reference to "nableToAcquireHashAlgorithmContext" (Indicator: "HashAlgorithm"; File: "AMSI") Found reference to "shSignature_Incompatible_HashAlgorithm" (Indicator: "HashAlgorithm"; File: "AMSI") Found reference to "asswordDeriveBytes" (Indicator: "DeriveBytes"; File: "AMSI") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp, 00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found reference to "CDSA/SHA384" (Indicator: "SHA384"; Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00007576.00000001.193168.7246F000.00000004.mdmp, 00000000-00007576.00000001.193168.72542000.00000004.mdmp")3c:T1750,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{9B74B6A3-0DFD-4F11-9E78-5F7800F2E772}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{DF7266AC-9274-4867-8D55-3BD661DE872D}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{339719B5-8C47-4894-94C2-D8F77ADD44A6}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{0D4C3DB6-03A3-462F-A0E6-08924C41B5D4}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B97D20BB-F46A-4C97-BA10-5E3608430854}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7CFBEFBC-DE1F-45AA-B843-A542AC536CC9}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{2F8B40C2-83ED-48EE-B383-A1F157EC6F9A}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{10C07CD0-EF91-4567-B850-448B77CB37F9}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PROPERTYBAG") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PROPERTYBAG")3d:Tb81,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" queried SystemProcessInformation at 00000000-00008688-00000C15-1791462373 [PID: 8688] "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" queried SystemProcessInformation at 00000000-00008688-00000C15-1791477519 [PID: 8688] "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" queried SystemProcessInformation at 00000000-00008688-00000C15-1791667018 [PID: 8688] "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" queried SystemProcessInformation at 00000000-00008688-00000C15-1791673971 [PID: 8688] "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" queried SystemProcessInformation at 00000000-00008688-00000C15-1791824724 [PID: 8688] "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" queried SystemProcessInformation at 00000000-00008688-00000C15-1791831297 [PID: 8688] "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" queried SystemProcessInformation at 00000000-00008688-00000C15-1794167755 [PID: 8688] "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" queried SystemProcessInformation at 00000000-00008688-00000C15-1794174688 [PID: 8688] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1795917609 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1795925007 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1796299666 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1796306282 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1827433032 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1856817000 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1856844238 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1861950365 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1867073421 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1872194923 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1882297414 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1882303186 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1882361965 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1882367173 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1882419215 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1887448389 [PID: 7604] "SaPub.exe" queried SystemProcessInformation at 00000000-00007604-00000C15-1892536616 [PID: 7604]3e:Tf01,Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CryptSetHashParam" (Indicator: "CryptSetHashParam"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CryptEnumProvidersW" (Indicator: "CryptEnumProvidersW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CryptSignHashW" (Indicator: "CryptSignHashW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CryptGetUserKey" (Indicator: "CryptGetUserKey"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CryptGetProvParam" (Indicator: "CryptGetProvParam"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStoreW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CertGetCertificateContextProperty" (Indicator: "CertGetCertificateContextProperty"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found api reference "CryptBinaryToStringW" (Indicator: "CryptBinaryToStringW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found api reference "CryptStringToBinaryW" (Indicator: "CryptStringToBinaryW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp")3f:T4289,"Akfshnr_x86.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDV/poQLjVsb85LnwsCuA0OwrdhOgJ9Idx88iVA/crVxKCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "Akfshnr_x86.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "Akfshnr_x86.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoTQYJKoZIhvcNAQcCoIIoPjCCKDoCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCiTZAF+ANUrO9osZ8sBThnPO+juwAYZMRBReF9eSjLWaCCDSkwggZwMIIEWKADAgECAhMzAAABI9" "cchString": "14196" "dwFlags": "1" "pbBinary": "3082284d06092a864886f70d010702a082283e3082283a020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420a24d9005f80354acef68b19f2c0538673cefa3bb001864c44145e17d7928cb59a0820d293082067030820458a00302010202133300000123d95dfc7026a28135000000000123300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933325a170d3237303432393138333933325a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100e0b2447b321b3a926eb411d4692a7ff00c074e1313ddfc65a06e8ff2bc0710bf30fd7da0cd809caab63c22b611319a264c176e3294f2aad59e71a352e3184cfa40babb929cb080bac2ddc98295ebf760777146f1d5c8a2e4118ca42a13fd9985b1845ea27fac86ff3f8ba15281fc29bd685a4bf106fd2b56064c5e0fc15ba5c844bf456ff13ead32db2d20c37353ebc91fc90db642ee818d9dceba701e632ddd53a8c754a9ab11d0402cf837b8f86e9010c346472fce64bba3c8b2e98d7b30c5ebdfc745cd62931c0f5f7949d602204f891612ea2d9e785cac27ad0836260a45db7872cce3795e6fda36baf94881f56bb3984b15b1ec1ab3e9a9c3bc8aee87431c3c979c2505f3e2bd81c9c0fdad4ae457dad6805246df09a70f31c8826cd39cbdc7843eb70932492839a994b55fa950b097a84784663d44bf7c25a5589f9474cd231b2063fbcd943a9d90baa098658d8494dab941753912a544e0beadf79c6e493b3c72b3f3e472881098569c6f33d13bc5e13e5b420b79719da8d592a76c750203010001a382019e3082019a300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414d1f31e81e6fa79075fa31e975354ed24848a0ec430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d697465643116" "pcbBinary": "51280000" "pdwFlags": "01000000"} "Akfshnr_x86.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoTQYJKoZIhvcNAQcCoIIoPjCCKDoCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14196" "dwFlags": "1" "pbBinary": "3082284d06092a864886f70d010702a082283e3082283a020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420a24d9005f80354acef68b19f2c0538673cefa3bb001864c44145e17d7928cb59a0820d293082067030820458a00302010202133300000123d95dfc7026a28135000000000123300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933325a170d3237303432393138333933325a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100e0b2447b321b3a926eb411d4692a7ff00c074e1313ddfc65a06e8ff2bc0710bf30fd7da0cd809caab63c22b611319a264c176e3294f2aad59e71a352e3184cfa40babb929cb080bac2ddc98295ebf760777146f1d5c8a2e4118ca42a13fd9985b1845ea27fac86ff3f8ba15281fc29bd685a4bf106fd2b56064c5e0fc15ba5c844bf456ff13ead32db2d20c37353ebc91fc90db642ee818d9dceba701e632ddd53a8c754a9ab11d0402cf837b8f86e9010c346472fce64bba3c8b2e98d7b30c5ebdfc745cd62931c0f5f7949d602204f891612ea2d9e785cac27ad0836260a45db7872cce3795e6fda36baf94881f56bb3984b15b1ec1ab3e9a9c3bc8aee87431c3c979c2505f3e2bd81c9c0fdad4ae457dad6805246df09a70f31c8826cd39cbdc7843eb70932492839a994b55fa950b097a84784663d44bf7c25a5589f9474cd231b2063fbcd943a9d90baa098658d8494dab941753912a544e0beadf79c6e493b3c72b3f3e472881098569c6f33d13bc5e13e5b420b79719da8d592a76c750203010001a382019e3082019a300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414d1f31e81e6fa79075fa31e975354ed24848a0ec430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d697465643116" "pcbBinary": "51280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDV/poQLjVsb85LnwsCuA0OwrdhOgJ9Idx88iVA/crVxKCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIoJQYJKoZIhvcNAQcCoIIoFjCCKBICAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "14138" "dwFlags": "1" "pbBinary": "3082282506092a864886f70d010702a082281630822812020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420d5fe9a102e356c6fce4b9f0b02b80d0ec2b7613a027d21dc7cf22540fdcad5c4a0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "29280000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIoIgYJKoZIhvcNAQcCoIIoEzCCKA8CAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCDRowggZhMIIESaADAgECAhMzAAABJF" "cchString": "14134" "dwFlags": "1" "pbBinary": "3082282206092a864886f70d010702a08228133082280f020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820d1a3082066130820449a003020102021333000001245da29171e02095aa000000000124300d06092a864886f70d01010c05003053310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312430220603550403131b57696e646f77732050726f64756374696f6e205043412032303233301e170d3236303433303138333933345a170d3237303432393138333933345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f7773308201a2300d06092a864886f70d01010105000382018f003082018a0282018100911f348d62498ba470aa25f578b7331e206dffa20eadcb9d7e8311a7bc383360823b502374ceaf65a48f43fe0c2333e5b226c1071a03980907af6a10e7e19ae8317a17e7f59551c90ced2c2de50e4b4d8ec1ef5fbcc9a824d038f51d0a2fe5dbc8013f88d97645bc1517b8c51a5e57781171d61065feb86e517fb676188e92cf97338149f97e64d903c0429e6f1ae3a24bda3e772fb6f5e7f84c46feece6edecf00c132255c00709485085d2094c52fd2ec26b27fc6d41d1b6cb0674b7d5ab0d214e095f47e31fd7ff61453388588732fe72a4aa30c97b3a7313a4ffe1563121dcee69eb618246c1349b6a382e8f2e9a776b218747271de0e38909a858bdf96ecc8d9ea3ab1564259a265f27d639eff1f603bf0634cb916b5bc5fd3b998a3fdd39decec493d9fa88c378b085bfb92b7645c0d42d3e13d44c12fe1a54d91a1da843d45f20eefe6e2389b96fd25d7f7994b84f6794eae156bdd7056748472b3fa3f2611f74d806ed84caae2c31d75e1d722d88bcab91b0a67fd03135f4ba74e58d0203010001a382018f3082018b300e0603551d0f0101ff040403020780301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e041604142b4eb0a3eedc4ec122deeaf891bb93e82198091430450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d353030343436" "pcbBinary": "26280000" "pdwFlags": "01000000"}40:T9cc,Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptEnumProvidersW" (Indicator: "CryptEnumProviders"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptSignHashW" (Indicator: "CryptSignHash"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptGetUserKey" (Indicator: "CryptGetUserKey"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptGetProvParam" (Indicator: "CryptGetProvParam"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptExportKey" (Indicator: "CryptExportKey"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStore"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe")41:T557,Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptGetUserKey" (Indicator: "CryptGetUserKey"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CryptExportKey" (Indicator: "CryptExportKey"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe")42:T551,Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00000568.00000000.193823.B4230000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00000924.00000000.195455.0BDF0000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002196.00000000.194802.207A0000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00002300.00000000.195132.7D930000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004508.00000000.194478.31D40000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004936.00000000.194154.8ED90000.00000004.mdmp") Found string ":\WINDOWS\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00006240.00000000.193500.4CEE0000.00000004.mdmp") Found string ":\WINDOWS\SYSTEM32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp, 00000000-00007576.00000001.193168.6FFE0000.00000004.mdmp")43:T5dc,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms44:Tb509,Found XOR loop in file "Akfshnr_x86.exe" at offset 11593; code bytes = 33c1 Found XOR loop in file "Akfshnr_x86.exe" at offset 262617; code bytes = 33c1 Found XOR loop in file "Akfshnr_x86.exe" at offset 425735; code bytes = 33c1 Found XOR loop in file "Akfshnr_x86.exe" at offset 1767415; code bytes = 30040e Found XOR loop in file "Akfshnr_x86.exe" at offset 3736479; code bytes = 30040e Found XOR loop in file "Akfshnr_x86.exe" at offset 179068; code bytes = 8030 Found XOR loop in file "Akfshnr_x86.exe" at offset 469534; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 1444652; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 2150922; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 2684884; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 3130197; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 3389728; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 3389736; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 3572069; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 3599104; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 3751844; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 3890532; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 4075704; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 4372736; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 4653332; code bytes = 30d0 Found XOR loop in file "msvcp140.dll" at offset 1158618; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1158651; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1158841; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1158863; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1167107; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1167157; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1167886; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1391182; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1395487; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1434377; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1434449; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1560751; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1560762; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1561075; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1561086; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1572378; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1572788; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1608451; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1636173; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1726969; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1727019; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1727052; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1727085; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1737829; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1738670; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1738725; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1738734; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1739614; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1739677; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1834934; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1835036; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1934341; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2114244; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2154177; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2160399; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2198513; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2204815; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2345123; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2345257; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2345389; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2346210; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2346327; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2346470; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2346609; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2488129; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2777910; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2777921; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2777980; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2778096; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2778154; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2779599; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2784220; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2784287; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2789142; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2789153; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2789215; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2789331; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2789389; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2792782; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2792831; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2792842; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2792855; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2792884; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2799947; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2800178; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2803659; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2803895; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2804131; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2804367; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2804603; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2804839; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2805093; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2817915; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2818089; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2818100; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2818789; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2818823; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2819140; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2819201; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2820450; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2820635; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2821368; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2821406; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2821509; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2827771; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2828468; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2829241; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2829427; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2829636; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2830329; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2830370; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2830902; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2830955; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2830994; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2831377; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2831419; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2833926; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2836320; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2836527; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2836733; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2837558; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2839951; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2840158; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2840364; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2845145; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2845220; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2845296; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2845591; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2845669; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2845891; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2845966; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2846042; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2846337; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2846415; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2848328; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2848403; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2848479; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2848774; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2848852; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2849074; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2849149; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2849225; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2849520; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2849598; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2851760; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2854116; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2854220; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2854333; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2854448; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2855911; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2856245; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2856693; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2856775; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2856922; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2857377; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2857468; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2857816; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2858037; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2858130; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2858286; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2858726; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2858813; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2858968; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2859410; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2859492; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2859833; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2860088; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2860167; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2860333; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2860779; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2860877; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2861031; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2861470; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2861848; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2861922; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2862140; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2862242; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2862384; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2862836; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2862928; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2863088; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2863783; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2863859; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2864545; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2864577; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2866196; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2866268; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2866439; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2866511; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2866873; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2866957; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2867097; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2867478; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2867558; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2868064; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2868142; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2868277; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2868656; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2868736; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2868882; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2869255; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2869330; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2869631; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2869833; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2869910; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2870051; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2870428; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2870507; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2870654; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2871027; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2871102; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2871398; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2871618; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2871684; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2871834; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2872039; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2875484; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2875577; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2875814; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2875908; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2876009; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2876183; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2876259; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2876453; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2876504; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2876623; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2876680; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2876821; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2876879; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2877056; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2877230; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2877424; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2877555; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2877561; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2877748; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2877929; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2877935; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2878108; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2878114; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2878268; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2878460; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2878878; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2879050; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2879238; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2879458; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2879464; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2879648; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2879654; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2879831; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2879837; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2880065; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2880255; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2880436; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2880609; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2880618; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2880838; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2881079; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2881189; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2881226; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2881327; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2881358; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2886390; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2886599; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2886673; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2886858; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2886884; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2887110; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2887136; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2887426; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2887689; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2887947; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2888194; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2888461; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2888741; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2888991; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2889268; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2889528; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2889794; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2890066; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2890339; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2890606; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2890840; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2890866; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2891099; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2891124; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2891364; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2891390; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2891624; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2891707; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2891896; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2891922; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2892161; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2892187; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2892421; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2892447; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2892691; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2892957; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2893227; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2893574; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2895136; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2895387; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2895412; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2895647; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2895671; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2895898; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2895923; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2896152; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2896176; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2896400; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2896425; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2896667; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2896695; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2896919; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2896953; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2897250; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2897363; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2897442; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2897561; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2897654; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2897753; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2897848; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2897930; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2898053; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2898150; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2898283; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2898378; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2951668; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2951764; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2951924; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2951966; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2964447; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2964516; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2964586; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2964656; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2964728; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2964798; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2964876; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2964937; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2965135; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2965204; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2965274; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2965344; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2965416; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2965486; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2965560; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2965621; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2967705; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2967770; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2967835; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2967900; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2967965; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2968868; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2968939; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2969010; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2969081; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 2983535; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 3001463; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 3050281; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 3058791; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 3058831; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 3063835; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 3067057; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 3118415; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 3573740; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 3702379; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 3719152; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 3764541; code bytes = 33c1 Found XOR loop in file "msvcp140.dll" at offset 1300720; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 2383868; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 2656396; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 3324047; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 3554648; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 3751964; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 3806187; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 3861866; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 4274760; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 4274792; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 4274824; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 4274856; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 4274888; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 4310290; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 4311697; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 4312336; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 4395688; code bytes = 8030 Found XOR loop in file "msvcp140.dll" at offset 4610548; code bytes = 8030 Found XOR loop in file "x64dbg.exe" at offset 114416; code bytes = 30d0 Found XOR loop in file "x64dbg.exe" at offset 13805; code bytes = 33c1 Found XOR loop in file "x64dbg.exe" at offset 13914; code bytes = 33c1 Found XOR loop in file "x64dbg.exe" at offset 14026; code bytes = 33c1 Found XOR loop in file "x64dbg.exe" at offset 32731; code bytes = 33c1 Found XOR loop in file "x64dbg.exe" at offset 108416; code bytes = 8030 Found XOR loop in file "x64dbg.exe" at offset 139924; code bytes = 8030 Found XOR loop in file "x64dbg.exe" at offset 171950; code bytes = 8030 Found XOR loop in file "x64dbg.exe" at offset 180907; code bytes = 8030 Found XOR loop in file "x64dbg.exe" at offset 182179; code bytes = 8030 Found XOR loop in file "x64dbg.exe" at offset 182287; code bytes = 8030 Found XOR loop in file "x64dbg.exe" at offset 183699; code bytes = 8030 Found XOR loop in file "GameSDKs" at offset 348607; code bytes = 30040e Found XOR loop in file "GameSDKs" at offset 414434; code bytes = 30040e Found XOR loop in file "GameSDKs" at offset 614111; code bytes = 30040e Found XOR loop in file "GameSDKs" at offset 1399919; code bytes = 30040e Found XOR loop in file "GameSDKs" at offset 1717785; code bytes = 30040e Found XOR loop in file "GameSDKs" at offset 2059660; code bytes = 30040e Found XOR loop in file "GameSDKs" at offset 2137615; code bytes = 30040e Found XOR loop in file "GameSDKs" at offset 2153387; code bytes = 30040e Found XOR loop in file "SaPub.exe" at offset 348607; code bytes = 30040e Found XOR loop in file "SaPub.exe" at offset 414434; code bytes = 30040e Found XOR loop in file "SaPub.exe" at offset 614111; code bytes = 30040e Found XOR loop in file "SaPub.exe" at offset 1399919; code bytes = 30040e Found XOR loop in file "SaPub.exe" at offset 1717785; code bytes = 30040e Found XOR loop in file "SaPub.exe" at offset 2059660; code bytes = 30040e Found XOR loop in file "SaPub.exe" at offset 2137615; code bytes = 30040e Found XOR loop in file "SaPub.exe" at offset 2153387; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 2791764; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2982142; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3028559; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3078728; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3120330; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3233619; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3391925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3462834; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3559538; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3560393; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3605483; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3634970; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3693583; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3718220; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3751770; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3756362; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3872688; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3881376; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3996178; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4069528; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4144421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4157351; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4199311; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4271634; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4304188; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4399974; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4618497; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4643806; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4669855; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4792343; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4911592; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4924039; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4931065; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4970574; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4997687; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5064014; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5065736; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5085665; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5099375; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5138901; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5151841; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5274751; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5351444; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5375647; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5390765; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5419571; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5438084; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5458180; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5461524; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5466685; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5673215; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5775156; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5891690; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6063142; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6124982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6181879; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6232816; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6243471; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6246655; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6478474; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6493174; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6592872; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6636892; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6670732; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6697567; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6722282; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2781988; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2860584; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2909369; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2952067; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3019825; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3020419; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3072372; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3362669; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3373336; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3504323; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3553902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3567352; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3713525; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3747817; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3829188; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3873538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3879566; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3938838; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4031399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4176264; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4179208; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4206680; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4288103; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4309617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4397493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4504998; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4537652; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4562701; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4566563; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4623222; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4741973; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4812194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4832961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4874248; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4989591; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5081367; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5087548; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5120797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5179191; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5272522; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5290745; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5307651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5333656; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5477654; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5482911; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5683963; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5785251; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5859936; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5902626; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5945344; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6200316; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6219578; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6231307; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6277033; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6284865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6297794; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6335391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6377136; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6405536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6446592; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6507165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 11068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 12916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 13180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 13532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 13708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 24683; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2680863; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2683195; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2684163; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2698947; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2699321; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2707835; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2714699; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2715227; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2717251; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2732827; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2735467; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2751219; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2754827; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2767477; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2770205; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2846957; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2919024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2980563; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3051593; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3078989; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3213725; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3300517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3415632; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3554723; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3624110; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3838831; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3851084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3868689; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3988441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4080578; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4126903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4271240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4277616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4331627; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4345054; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4432034; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4449767; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4471926; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4486197; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4711450; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4770642; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4780076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4801209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4891693; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4980543; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5002684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5130967; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5308027; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5344813; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5476616; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5565055; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5596998; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5764329; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5824375; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5860440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5988833; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6131762; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6155090; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6177305; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6183234; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6217225; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6217496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6284203; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6350956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6363754; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6472626; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6508146; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6528066; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6572362; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6768815; code bytes = 803045:T433,Found string "QueryServiceConfig2" (Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found string "EnumServicesStatusEx" (Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found string "EnumServicesStatus" (Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found string "QueryServiceStatusEx" (Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found string "QueryServiceConfig2 (delayed autostart flag)" (Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found string "QueryServiceConfig" (Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found string "QueryServiceConfig2W" (Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found string "QueryServiceConfigW" (Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found string "EnumServicesStatusExW" (Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found string "QueryServiceStatus" (Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp")46:T1d8e,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000001100070080f4af00580dcd008370fb76580dcd000000000028000000000000000000cd00000000000000000000000000000000004482ff76f853ce000000cd0028f5af006400000000000000 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000006205be60fb76a0a5a276be60fb760000000000000000000000000d00000000000000030000000d0000007e000000030000007827d40094e36205db3d9475501ba275af3d9475178e088f0d0000007e0000000300000000000000b9b0fc7610a5a276f0e36205d01f97756bbdcafffeffffffc4e362050300000080bece75a0a5a276b4e3620591bece75030000000000000000e462053b3c9475030000000000000068db9a76000000009d1a9475841a94758389088f68db9a7692000000a0a5a27600000000c041b776fce3620578e46205d01f97752ba2cafffeffffff0ce46205101a9475d041b7761ce46205e52fb076e099ee76d041b77628e46205 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000b83acd0001000000ecd16205a100fc767000fc76c62557d76453dc751601fc76000000000f000000a0a5cd0047afd40000000000ac83797000000000d017d975bccf62050000cd000000000004000000d0a9cf746453dc75000000006453dc7501000000f0e04b71cc97da75f0e04b71e051d20000000000b8cf6205f0e04b710200000004010000020000002900000068000000540000000cd0620593c54a7104f9d400ce4d22890000000050c54a7109c64a7108f9d400020000000000000000000000987880574f8c6244bb6371042380b1090000000000584f712c7b357100000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000620520e7cd7500f6d40002ffff7fe0035f7024d4620501000000fc0000000000000060cf620543003a005c00550073006500720073005c004800410050005500420057005300000050005500420057005300000062056453dc75000000006453dc75010000003f460000a0a5cd0054d162056274fb764b8ffb76722557d700003100320030003700330036003100300030003100fc76ca3b57d70cd0620593c54a718cf6d400ce4d22890000000050c54a7109c64a7190f6d400020000000000000000000000987880574f8c6244bb6371042380b1090000000000584f712c7b357100000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000620520e7cd7550f4d40002ffff7fe0035f7024d4620501000000fc0000000000000060cf620543003a005c00550073006500720073005c004800410050005500420057005300000050005500420057005300000062056453dc75000000006453dc75010000003f460000a0a5cd0054d162056274fb764b8ffb76722557d700003100320030003700330036003100300030003100fc76ca3b57d70cd0620593c54a718cf6d400ce4d22890000000050c54a7109c64a7190f6d400020000000000000000000000987880574f8c6244bb6371042380b1090000000000584f712c7b357100000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000620520e7cd7570efd40002ffff7fe0035f7024d4620501000000fc0000000000000060cf620543003a005c00550073006500720073005c004800410050005500420057005300000050005500420057005300000062056453dc75000000006453dc75010000003f460000a0a5cd0054d162056274fb764b8ffb76722557d700003100320030003700330036003100300030003100fc76ca3b57d70cd0620593c54a71dc41d500ce4d22890000000050c54a7109c64a71e041d500020000000000000000000000987880574f8c6244bb6371042380b1090000000000584f712c7b357100000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000620520e7cd75e0f1d40002ffff7fe0035f7024d4620501000000fc0000000000000060cf620543003a005c00550073006500720073005c004800410050005500420057005300000050005500420057005300000062056453dc75000000006453dc75010000003f460000a0a5cd0054d162056274fb764b8ffb76722557d700003100320030003700330036003100300030003100fc76ca3b57d70cd0620593c54a713479d500ce4d22890000000050c54a7109c64a713879d500020000000000000000000000987880574f8c6244bb6371042380b1090000000000584f712c7b357100000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000620520e7cd7580f4d40002ffff7fe0035f7024d4620501000000fc0000000000000060cf620543003a005c00550073006500720073005c004800410050005500420057005300000050005500420057005300000062056453dc75000000006453dc75010000003f460000a0a5cd0054d162056274fb764b8ffb76722557d700003100320030003700330036003100300030003100fc76ca3b57d70cd0620593c54a71948dd500ce4d22890000000050c54a7109c64a71988dd500020000000000000000000000987880574f8c6244bb6371042380b1090000000000584f712c7b357100000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006bc6fc76da3c57d7100000000100000088c9620500000000000000000000cd000d000000000000007d23637611000000b8c862050000000054ca620570b5fe76000000000000000020c9620591c5fc7688c962051100000001000000ffffffff00000000306acd005050cd00040000005cc9620593c54a718cc8d5009e5422890000000050c54a7109c64a7190c8d500020000000000000000000000987880574f8c6244bb6371042380b1090000000000584f712c7b357100000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00008688)47:T8b3,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "SaPub.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "h ?1?.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "h ?1?.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Akfshnr_x86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Akfshnr_x86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "Akfshnr_x86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "Akfshnr_x86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "Akfshnr_x86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "Akfshnr_x86.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")48:T1268,Found reference to API "915406870,9000,3024,,RtlGetVersion,NTDLL.dll,"00:49:18.765",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "917569700,9000,3024,,RtlGetVersion,NTDLL.dll,"00:49:18.781",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "0447380760,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0452183944,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0449408276,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0450941696,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0447572732,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0441268398,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0455405424,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0454438112,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0445735124,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0456535160,5152,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0436916726,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.953",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0453531684,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0433289440,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.953",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0451975226,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API "lGetVersion,NTDLL.dll,"00:50:08.843",RX=0,P" (Indicator: "GetVersion"; Source: "00000000-00007576.00000001.193168.72433000.00000004.mdmp") Found reference to API "8644789346,9120,3024,,RtlGetVersion,NTDLL.dll,"00:50:18.218",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found reference to API "8645058902,9120,3024,,RtlGetVersion,NTDLL.dll,"00:50:18.218",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found reference to API "8645187330,9120,3024,,RtlGetVersion,NTDLL.dll,"00:50:18.218",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found reference to API "GetVersion,NTDLL.dll,"00:50:11.890",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found reference to API "8577085594,5520,3024,,RtlGetVersion,NTDLL.dll,"00:50:18.187",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp")49:T15ac,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" queries volume information of "C:\a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" at 00000000-00008688-00000C17-1792857929 "Akfshnr_x86.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Reflection.dll" at 00000000-00008224-00000C17-1800138701 "Akfshnr_x86.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.dll" at 00000000-00008224-00000C17-1800201171 "Akfshnr_x86.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00008224-00000C17-1802416310 "Akfshnr_x86.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00008224-00000C17-1802862203 "Akfshnr_x86.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00008224-00000C17-1803300704 "Akfshnr_x86.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008224-00000C17-1803585859 "Akfshnr_x86.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-ServerCommon-Package~31bf3856ad364e35~amd64~~10.0.19041.5794.cat" at 00000000-00008224-00000C17-1894633996 "Akfshnr_x86.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00008224-00000C17-1894736874 "Akfshnr_x86.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll" at 00000000-00008224-00000C17-1894767970 "Akfshnr_x86.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll" at 00000000-00008224-00000C17-1894775332 "Akfshnr_x86.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll" at 00000000-00008224-00000C17-1895022159 "Akfshnr_x86.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\IISAdministration\Microsoft.IIS.PowerShell.Commands.dll" at 00000000-00008224-00000C17-1895040644 "Akfshnr_x86.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.IIS.PowerShell.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.IIS.PowerShell.Commands.dll" at 00000000-00008224-00000C17-1895045177 "Akfshnr_x86.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.IIS.PowerShell.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.IIS.PowerShell.Commands.dll" at 00000000-00008224-00000C17-1895406649 "Akfshnr_x86.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Web.Administration\7.0.0.0__31bf3856ad364e35\Microsoft.Web.Administration.dll" at 00000000-00008224-00000C17-1895427733 "Akfshnr_x86.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.6280.cat" at 00000000-00008224-00000C17-1896082435 "Akfshnr_x86.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00008224-00000C17-1896151711 "Akfshnr_x86.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll" at 00000000-00008224-00000C17-1896315613 "Akfshnr_x86.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00008224-00000C17-1896398920 "Akfshnr_x86.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00008224-00000C17-1896477101 "Akfshnr_x86.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll" at 00000000-00008224-00000C17-1896590878 "Akfshnr_x86.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00008224-00000C17-1896781476 "Akfshnr_x86.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00008224-00000C17-1896964142 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.19041.6456.cat" at 00000000-00007576-00000C17-18331786164a:T52a,Found reference to API "OpenSCManager" (Indicator: "OpenSCManager"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "EnumServicesStatusEx" (Indicator: "EnumServicesStatus"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "EnumServicesStatus" (Indicator: "EnumServicesStatus"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "EnumDependentServices" (Indicator: "EnumDependentServices"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "EnumServicesStatusExW" (Indicator: "EnumServicesStatus"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "EnumDependentServicesW" (Indicator: "EnumDependentServices"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp")4b:T515,"Akfshnr_x86.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "Akfshnr_x86.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Akfshnr_x86.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Akfshnr_x86.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "Akfshnr_x86.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "Akfshnr_x86.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "Akfshnr_x86.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "Akfshnr_x86.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "Akfshnr_x86.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "Akfshnr_x86.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")4c:T8681,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\ef4992f14ba62dc115c01e7a6018e263\mscorlib.ni.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\67186481d97828a572bf5db055f4a9f1\System.ni.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\c20afd70aeb352395f8f5297a727f0ba\System.Core.ni.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008688) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\481f1a5c0959042363de5c765867b51d\System.Management.Automation. (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P1706cafe#\8538ceecb635b7b5344519fc3915a42d\Microsoft.PowerShell.Commands (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\9594c82af7b396b5ee8b0ef1d461cea2\System.Configuration.Install. (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\704b6614c4744d16332d08daf175deed\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\b91d832f8c25f4f949d6dc38b3fe41ac\Microsoft.PowerShell.Commands (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\4775ea5a6170c0859c5278277c31b0ca\Microsoft.PowerShell.Commands (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\ed7aa14224280131dbac4b6e4881239a\Microsoft.Management.Infrastr (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\11606f766159ae0c6dc59f2c053f4db7\Microsoft.PowerShell.Security (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.We0722664#\a5ede660c06b4501cdc6e7f88a4f844b\Microsoft.WSMan.Management.ni (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\9c3b10f6a55214655267f1cbc0e14caa\Microsoft.Management.Infrastr (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Ibaae5ed9#\84fad413887aee40f2561c249a4c8916\Microsoft.IIS.Powershell.Comm (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Kd58820a5#\8b4864381f82810983b8d5999e809049\Microsoft.KeyDistributionServ (UID: 00000000-00008224) "Akfshnr_x86.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDis (UID: 00000000-00008224) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\704b6614c4744d16332d08daf175deed\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\481f1a5c0959042363de5c765867b51d\System.Management.Automation. (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter Kernel32 (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter NtDll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\ed7aa14224280131dbac4b6e4881239a\Microsoft.Management.Infrastr (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\76ff225c5a523f0be2364b0fc02bf7f9\System.Xml.ni.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\8ecda6b0ffa321000faffbdcdb86175b\System.Management.ni.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\afd58c711db7cac7f0d5caf525ce8d6c\System.DirectoryServices.ni.d (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\8990b2f5a93202518a0040e15b565f36\System.Data.ni.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\24206316825bb75ebfbdd31895df2f1f\System.Configuration.ni.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\11606f766159ae0c6dc59f2c053f4db7\Microsoft.PowerShell.Security (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\beabd14f0ab9a67d348911645772e933\System.Transactions.ni.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\9c3b10f6a55214655267f1cbc0e14caa\Microsoft.Management.Infrastr (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\b91d832f8c25f4f949d6dc38b3fe41ac\Microsoft.PowerShell.Commands (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\9594c82af7b396b5ee8b0ef1d461cea2\System.Configuration.Install. (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\4775ea5a6170c0859c5278277c31b0ca\Microsoft.PowerShell.Commands (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00007576) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00007576)4d:T184d9,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetTempPath2A (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetTempPath2 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00008688) "SaPub.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007604) "SaPub.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007604) "SaPub.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007604) "SaPub.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007604) "SaPub.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007604) "SaPub.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007604) "h ?1?.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001168) "h ?1?.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001168) "h ?1?.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001168) "h ?1?.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001168) "h ?1?.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001168) "h ?1?.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001168) "h ?1?.exe" called "GetProcAddress" with a parameter GetHandleInformation (UID: 00000000-00001168) "h ?1?.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001168) "h ?1?.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00001168) "h ?1?.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001168) "h ?1?.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001168) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CLRCreateInstance (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SysAllocStringByteLen (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry_RetAddr (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetCurrentDirectory (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_GetInstance (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetTempPath2A (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetTempPath2 (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00008224) "Akfshnr_x86.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00008224) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2A (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath2 (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryAllFeatureConfigurations (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_GetInstance (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00007576) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00007576) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006568) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006568) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006568) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006568) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006568) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006568) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006240) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006240) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006240) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006240) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006240) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006240) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000568) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000568) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000568) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000568) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000568) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000568) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004936) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004936) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004936) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004936) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004936) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004936) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004508) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004508) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004508) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004508) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004508) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004508) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002196) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002196) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002196) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002196) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002196) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002196) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002300) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002300) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002300) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002300) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002300) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002300) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000924) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000924) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000924) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000924) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000924) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000924) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001636) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001636) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001636) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001636) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001636) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001636) "sc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000284) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000284) "sc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000284) "sc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000284) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000284) "sc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000284)4e:Tc8b4,Found reference to API (Indicator: "CryptDecrypt"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CryptSetHashParam"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CryptCreateHash"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CryptReleaseContext"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "DeregisterEventSource"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CryptDestroyKey"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CryptDestroyHash"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CryptEnumProvidersW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CryptSignHashW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "RegisterEventSourceW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CryptGenRandom"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CryptGetUserKey"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CryptAcquireContextW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CryptGetProvParam"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CryptExportKey"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "ReportEventW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CertCloseStore"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CertOpenSystemStoreW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CertDuplicateCertificateContext"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CertFindCertificateInStore"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CertGetCertificateContextProperty"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CertOpenStore"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetOEMCP"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "HeapFree"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "TlsGetValue"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CreateEventW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "VirtualFree"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "Sleep"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "InitializeSRWLock"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "ExitProcess"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "ReadFile"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CreateThread"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "TlsSetValue"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "HeapSize"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetStdHandle"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "AcquireSRWLockShared"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "HeapAlloc"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "FindNextFileW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "LCMapStringW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SetLastError"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "ReleaseSRWLockShared"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CompareStringW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CreateSemaphoreA"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "ReadConsoleA"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "ExitThread"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "FindClose"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SetConsoleTextAttribute"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "VirtualProtectEx"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "IsValidLocale"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "TlsFree"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "FreeConsole"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "TerminateProcess"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "TlsAlloc"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SetStdHandle"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetACP"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetLastError"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "FreeLibrary"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetSystemTime"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SetEvent"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "VirtualProtect"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "RtlUnwind"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "FormatMessageA"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetCPInfo"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "VariantClear"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SafeArrayPutElement"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "VariantInit"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SafeArrayCreate"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SafeArrayGetUBound"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SysAllocString"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SysFreeString"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SafeArrayAccessData"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "MessageBoxW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WinHttpSetTimeouts"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WinHttpOpen"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WinHttpQueryHeaders"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WinHttpReadData"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WinHttpReceiveResponse"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WinHttpSendRequest"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WinHttpOpenRequest"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WinHttpConnect"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "recvfrom"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "closesocket"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "htonl"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WSASetLastError"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "inet_ntoa"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "getservbyport"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "getpeername"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WSACleanup"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "getservbyname"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "gethostbyaddr"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "gethostbyname"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "ntohs"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "ioctlsocket"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "getsockopt"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "getsockname"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "htons"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "WSAStartup"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "inet_addr"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "VirtualQuery"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API (Indicator: "GetHandleInformation"; Source: "00000000-00001168.00000000.189609.009F4000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00001168.00000000.189609.009F4000.00000002.mdmp, 00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00001168.00000000.189609.009F4000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00001168.00000000.189609.009F4000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassExA"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API (Indicator: "OpenService"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManager"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusEx"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatus"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatusEx"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "StartService"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "ControlServiceEx"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfig"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "CreateService"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "EnumDependentServices"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceObjectSecurity"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptor"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptor"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "SetServiceObjectSecurity"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfig"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "RtlCreateServiceSid"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSid"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "CryptBinaryToStringW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptorW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "CreateServiceW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "CryptStringToBinaryW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "UuidEqual"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "RtlAdjustPrivilege"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "I_RpcExceptionFilter"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp")4f:T4eb,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp")50:T9e0,"KEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\" in Source: AMSI "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp "try\Machine\Software\Classes\W" in Source: 00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp 00000000-00007576.00000001.193168.70007000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007576.00000001.193168.595AB000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007576.00000001.193168.595AB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007576.00000001.193168.595AB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007576.00000001.193168.595AB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007576.00000001.193168.595AB000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007576.00000001.193168.595AB000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007576.00000001.193168.72290000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007576.00000001.193168.72290000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007576.00000001.193168.72362000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007576.00000001.193168.72433000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007576.00000001.193168.72433000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00007576.00000001.193168.72542000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007576.00000001.193168.72542000.00000004.mdmp "\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-" in Source: 00000000-00007576.00000001.193168.725F9000.00000004.mdmp51:Tadb,Process a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8688:168:WilStaging_02" Process a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8688:64:WilError_03" Process a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8688:64:WilError_03" Process a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe created mutex with name "Local\SM0:8688:168:WilStaging_02" Process a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe created mutex with name "Local\SM0:8688:64:WilError_03" Process a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe created mutex with name "SM0:8688:168:WilStaging_02" Process a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe created mutex with name "SM0:8688:64:WilError_03" Process a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8688:168:WilStaging_02" Process SaPub.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7604:304:WilStaging_02" Process SaPub.exe created mutex with name "\BaseNamedObjects\nedawykbudvincowahyoeovy" Process SaPub.exe created mutex with name "SM0:7604:304:WilStaging_02" Process h ?1?.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1168:304:WilStaging_02" Process h ?1?.exe created mutex with name "SM0:1168:304:WilStaging_02" Process Akfshnr_x86.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8224:304:WilStaging_02" Process Akfshnr_x86.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8224:120:WilError_03" Process Akfshnr_x86.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process Akfshnr_x86.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process Akfshnr_x86.exe created mutex with name "Local\SM0:8224:304:WilStaging_02" Process Akfshnr_x86.exe created mutex with name "Local\ZonesCacheCounterMutex" Process Akfshnr_x86.exe created mutex with name "SM0:8224:304:WilStaging_02" Process Akfshnr_x86.exe created mutex with name "Local\SM0:8224:120:WilError_03" Process Akfshnr_x86.exe created mutex with name "SM0:8224:120:WilError_03" Process Akfshnr_x86.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process Akfshnr_x86.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8224:304:WilStaging_02" Process Akfshnr_x86.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8224:120:WilError_03"52:T2867,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "Akfshnr_x86.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]53:Tcc4,"SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp "try\Machine\Software\Classes\W" in Source: 00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007576.00000001.193168.595AB000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007576.00000001.193168.595AB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007576.00000001.193168.595AB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007576.00000001.193168.595AB000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007576.00000001.193168.595AB000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007576.00000001.193168.595AB000.00000002.mdmp "try\Machine\Software\Classes\W" in Source: 00000000-00007576.00000001.193168.70007000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007576.00000001.193168.72290000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007576.00000001.193168.72290000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007576.00000001.193168.72362000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007576.00000001.193168.72433000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007576.00000001.193168.72433000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00007576.00000001.193168.72542000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007576.00000001.193168.72542000.00000004.mdmp "\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-" in Source: 00000000-00007576.00000001.193168.725F9000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008688.00000000.189291.00CD0000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock" in Source: 00000000-00008688.00000000.189291.00CD0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008688.00000000.189291.00CD0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00008688.00000000.189291.00CD0000.00000004.mdmp "istry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00008688.00000000.189291.00CD0000.00000004.mdmp54:T6108,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74b50000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "ADVAPI32.DLL" at base 76330000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75bc0000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75bc0000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75bc0000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 74aa0000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "SHLWAPI.DLL" at base 763b0000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74a90000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "VERSION.DLL" at base 74a80000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 74230000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "USER32.DLL" at base 76400000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75bc0000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "MSCOREE.DLL" at base 74d80000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 765a0000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "PSAPI.DLL" at base 75450000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "RPCRT4.DLL" at base 76270000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "KERNEL32.DLL" at base 75640000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\EF4992F14BA62DC115C01E7A6018E263\MSCORLIB.NI.DLL" at base 72d00000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "OLE32.DLL" at base 76890000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 765a0000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 75bc0000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72c70000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\67186481D97828A572BF5DB055F4A9F1\SYSTEM.NI.DLL" at base 72210000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\C20AFD70AEB352395F8F5297A727F0BA\SYSTEM.CORE.NI.DLL" at base 719f0000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 71970000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "SHELL32.DLL" at base 76980000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 71260000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 71350000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 70d60000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 71070000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "SSPICLI.DLL" at base 70d30000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 75bc0000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "VIRTDISK.DLL" at base 70d20000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 70c40000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 70c40000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 70bc0000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\SYSWOW64\ONECORECOMMONPROXYSTUB.DLL" at base 70ac0000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 70700000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "NTDLL.DLL" at base 76f70000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74cd0000 "SaPub.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff85cf50000 "h ?1?.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff85cf50000 "h ?1?.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff87e0a0000 "h ?1?.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff880b20000 "h ?1?.exe" loaded module "NTDLL.DLL" at base 7ff883070000 "h ?1?.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ff87db10000 "h ?1?.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff87e4b0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff85cf50000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff880750000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff880750000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ff880750000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff880750000 "Akfshnr_x86.exe" loaded module "KERNEL32" at base 7ff882190000 "Akfshnr_x86.exe" loaded module "ADVAPI32.DLL" at base 7ff8826d0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff85a130000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff87e4b0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff857ef0000 "Akfshnr_x86.exe" loaded module "USER32.DLL" at base 7ff881090000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff880750000 "Akfshnr_x86.exe" loaded module "MSCOREE.DLL" at base 7ff8629d0000 "Akfshnr_x86.exe" loaded module "SHLWAPI.DLL" at base 7ff881360000 "Akfshnr_x86.exe" loaded module "NTDLL" at base 7ff883070000 "Akfshnr_x86.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff8817d0000 "Akfshnr_x86.exe" loaded module "PSAPI.DLL" at base 7ff882790000 "Akfshnr_x86.exe" loaded module "RPCRT4.DLL" at base 7ff881240000 "Akfshnr_x86.exe" loaded module "KERNEL32.DLL" at base 7ff882190000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7ff856890000 "Akfshnr_x86.exe" loaded module "OLE32.DLL" at base 7ff881cd0000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8817d0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff87f6d0000 "Akfshnr_x86.exe" loaded module "OLEAUT32.DLL" at base 7ff881e00000 "Akfshnr_x86.exe" loaded module "WLDP.DLL" at base 7ff880050000 "Akfshnr_x86.exe" loaded module "AMSI.DLL" at base 7ff871a50000 "Akfshnr_x86.exe" loaded module "%WINDIR%\SYSTEM32\9SLNHV12.DLL" at base 7ff87d9e0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff880b20000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7ff855c10000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\21FF4BA4607B18A9B179AB90FD3B0BC1\SYSTEM.CORE.NI.DLL" at base 7ff853b90000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\481F1A5C0959042363DE5C765867B51D\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff849140000 "Akfshnr_x86.exe" loaded module "VERSION.DLL" at base 7ff877650000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff880750000 "Akfshnr_x86.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff855ac0000 "Akfshnr_x86.exe" loaded module "SHELL32.DLL" at base 7ff882820000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P1706CAFE#\8538CEECB635B7B5344519FC3915A42D\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS.NI.DLL" at base 7ff85de20000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\9594C82AF7B396B5EE8B0EF1D461CEA2\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff8699a0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\704B6614C4744D16332D08DAF175DEED\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff855890000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\B91D832F8C25F4F949D6DC38B3FE41AC\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff852e80000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\4775EA5A6170C0859C5278277C31B0CA\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff852c40000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\ED7AA14224280131DBAC4B6E4881239A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff859fd0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\11606F766159AE0C6DC59F2C053F4DB7\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff85a480000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.WE0722664#\A5EDE660C06B4501CDC6E7F88A4F844B\MICROSOFT.WSMAN.MANAGEMENT.NI.DLL" at base 7ff8557f0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff854c50000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\76FF225C5A523F0BE2364B0FC02BF7F9\SYSTEM.XML.NI.DLL" at base 7ff848890000 "Akfshnr_x86.exe" loaded module "NTDLL.DLL" at base 7ff883070000 "Akfshnr_x86.exe" loaded module "BCRYPT.DLL" at base 7ff880bb0000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff8817d0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\8990B2F5A93202518A0040E15B565F36\SYSTEM.DATA.NI.DLL" at base 7ff847f10000 "Akfshnr_x86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff8528d0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\8ECDA6B0FFA321000FAFFBDCDB86175B\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff852760000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\AFD58C711DB7CAC7F0D5CAF525CE8D6C\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff8525f0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\BEABD14F0AB9A67D348911645772E933\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff851d30000 "Akfshnr_x86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff8668a0000 "Akfshnr_x86.exe" loaded module "SECUR32.DLL" at base 7ff8746a0000 "Akfshnr_x86.exe" loaded module "SSPICLI.DLL" at base 7ff8805e0000 "Akfshnr_x86.exe" loaded module "COMBASE.DLL" at base 7ff8817d0000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff8817d0000 "Akfshnr_x86.exe" loaded module "WINTRUST.DLL" at base 1fcf06f0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff880c60000 "Akfshnr_x86.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff87dbb0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff87daf0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff874060000 "Akfshnr_x86.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 7ff87dce0000 "Akfshnr_x86.exe" loaded module "CRYPT32.DLL" at base 7ff880c60000 "Akfshnr_x86.exe" loaded module "OLEAUT32" at base 7ff881e00000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\9C3B10F6A55214655267F1CBC0E14CAA\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff873fb0000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ff880750000 "Akfshnr_x86.exe" loaded module "MSVCRT.DLL" at base 7ff882f90000 "Akfshnr_x86.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff87dae0000 "Akfshnr_x86.exe" loaded module "MI.DLL" at base 7ff8764c0000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ff880750000 "Akfshnr_x86.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ff876420000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff880750000 "Akfshnr_x86.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff872860000 "Akfshnr_x86.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff871fc0000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff880750000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff880750000 "Akfshnr_x86.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff872110000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ff882190000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ff880750000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.IBAAE5ED9#\84FAD413887AEE40F2561C249A4C8916\MICROSOFT.IIS.POWERSHELL.COMMANDS.NI.DLL" at base 7ff8724c0000 "Akfshnr_x86.exe" loaded module "URLMON.DLL" at base 7ff873d70000 "Akfshnr_x86.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff880750000 "Akfshnr_x86.exe" loaded module "VIRTDISK.DLL" at base 7ff86cc90000 "Akfshnr_x86.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.KD58820A5#\8B4864381F82810983B8D5999E809049\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.NI.DLL" at base 7ff873f80000 "Akfshnr_x86.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.DLL" at base 7ff87b340000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff85cf50000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff8826d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff880750000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff880750000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff880750000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff85a130000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff881360000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff87e4b0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff877650000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff857ef0000 "powershell.exe" loaded module "USER32.DLL" at base 7ff881090000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff880750000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff8629d0000 "powershell.exe" loaded module "NTDLL" at base 7ff883070000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff8817d0000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff882790000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff881240000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff882190000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7ff856890000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff881cd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff8817d0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff881e00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7ff855c10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\21FF4BA4607B18A9B179AB90FD3B0BC1\SYSTEM.CORE.NI.DLL" at base 7ff853b90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\704B6614C4744D16332D08DAF175DEED\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff855890000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff87f6d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff880b20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\481F1A5C0959042363DE5C765867B51D\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff849140000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff8817d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff8817d0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff883070000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff882820000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff880be0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff880c60000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff880050000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff871a50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff87daf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff87dad0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ff874060000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 7ff87dac0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff880c60000 "powershell.exe" loaded module "KERNEL32" at base 7ff882190000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\9SLNHV12.DLL" at base 7ff87d9e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\ED7AA14224280131DBAC4B6E4881239A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff859fd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\76FF225C5A523F0BE2364B0FC02BF7F9\SYSTEM.XML.NI.DLL" at base 7ff848890000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\8ECDA6B0FFA321000FAFFBDCDB86175B\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff852760000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\AFD58C711DB7CAC7F0D5CAF525CE8D6C\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff8525f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\8990B2F5A93202518A0040E15B565F36\SYSTEM.DATA.NI.DLL" at base 7ff847f10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff8528d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\24206316825BB75EBFBDD31895DF2F1F\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff854c50000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff880bb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff880750000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff855ac0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\11606F766159AE0C6DC59F2C053F4DB7\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff85a480000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\BEABD14F0AB9A67D348911645772E933\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff851d30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff8668a0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff8746a0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff8805e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff87e0a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff8817d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\9C3B10F6A55214655267F1CBC0E14CAA\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ff873fb0000 "powershell.exe" loaded module "URLMON.DLL" at base 7ff873d70000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff880750000 "powershell.exe" loaded module "VIRTDISK.DLL" at base 7ff86cc90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 7ff872470000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\B91D832F8C25F4F949D6DC38B3FE41AC\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff852e80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\9594C82AF7B396B5EE8B0EF1D461CEA2\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff8699a0000 "powershell.exe" loaded module "OLEAUT32" at base 7ff881e00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\4775EA5A6170C0859C5278277C31B0CA\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff852c40000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ff880750000 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ff882f90000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ff87dab0000 "powershell.exe" loaded module "MI.DLL" at base 7ff8764c0000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ff880750000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ff876420000 "powershell.exe" loaded module "GDI32.DLL" at base 7ff881ee0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff880750000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff872860000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff871fc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff880750000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff880750000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff872110000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ff882190000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ff880750000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff85cf50000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ff882190000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ff883070000 "sc.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff85cf50000 "sc.exe" loaded module "RPCRT4.DLL" at base 7ff88124000055:T48c,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 76250000 "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 754E0000 "SaPub.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 80BB0000 "h ?1?.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 80BB0000 "h ?1?.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 80B20000 "Akfshnr_x86.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 80BB0000 "Akfshnr_x86.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 80B20000 "powershell.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 80BB0000 "powershell.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 80B20000 "cmd.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 80BB0000 "sc.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 80BB0000 "wusa.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 80BB0000 "wusa.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 80B20000 "powercfg.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 80BB000056:Te3d,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" touched "UsersFiles" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\INPROCSERVER32") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\PROGID") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\PROGID") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\PROGID") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "Akfshnr_x86.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "Akfshnr_x86.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "Akfshnr_x86.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "Akfshnr_x86.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "Akfshnr_x86.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "Akfshnr_x86.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "Akfshnr_x86.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "Akfshnr_x86.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS")57:Ta62,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "msvcp140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1802f98b5,call 0x1802fa0dc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1802f976c,int3 ,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x1802f98f4,mov eax, 1,add rsp, 0x28,ret ,int3 ,int3 ,int3 ,push rbx," "x64dbg.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140008b68,add rsp, 0x28,jmp 0x1400085d8,int3 ,int3 ,ret 0,int3 ,sub rsp, 0x48,lea rcx, [rsp + 0x20],call 0x140007ea8,lea rdx, [rip + 0x1c7af],lea rcx, [rsp + 0x20],call 0x1400092a8,int3 ,sub rsp, 0x48,lea rcx, [rsp + 0x20],call 0x140001370,lea rdx, [rip + 0x1c6ff],lea rcx, [rsp + 0x20],call 0x1400092a8,int3 ,jmp 0x14000f4c0,int3 ,int3 ,int3 ,push rbx," "GameSDKs" file has an entrypoint instructions - "sub rsp, 0x28,mov rax, qword ptr [rip + 0x8ed5],mov dword ptr [rax], 1,call 0x140001160,nop ,nop ,nop ,add rsp, 0x28,ret ,nop ,push r15,push r14,push rsi,push rdi,push rbx,sub rsp, 0x20,mov rax, qword ptr gs:[0x30],mov rdi, qword ptr [rax + 8],mov rsi, qword ptr [rip + 0x8ec9],xor eax, eax,lock cmpxchg qword ptr [rsi], rdi,sete bl,je 0x1400011b9,cmp rdi, rax,je 0x1400011b9,mov r14, qword ptr [rip + 0xaa51],nop word ptr [rax + rax],"58:T76a,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NATION") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "h ?1?.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "h ?1?.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Akfshnr_x86.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Akfshnr_x86.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Akfshnr_x86.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "Akfshnr_x86.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "Akfshnr_x86.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "Akfshnr_x86.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")59:Tf44,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00008688-00000C2E-1146358464] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00008688-00000C2B-1792398708] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00008688-00000C2B-1792492340] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00008688-00000C2B-1792548859] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\ef4992f14ba62dc115c01e7a6018e263\mscorlib.ni.dll" [Source: 00000000-00008688-00000C2B-1792831803] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00008688-00000C2B-1792859412] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00008688-00000C2B-1792911920] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00008688-00000C2B-1792987332] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\67186481d97828a572bf5db055f4a9f1\System.ni.dll" [Source: 00000000-00008688-00000C2B-1793124259] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\c20afd70aeb352395f8f5297a727f0ba\System.Core.ni.dll" [Source: 00000000-00008688-00000C2B-1793173002] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00008688-00000C2B-1793969534] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00008688-00000C2B-1793992907] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00008688-00000C2B-1794016386] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00008688-00000C2B-1794101707] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00008224-00000C2E-1497391806] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00008224-00000C2B-1798546999] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00008224-00000C2B-1798647601] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll" [Source: 00000000-00008224-00000C2B-1799030193] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00008224-00000C2B-1799072431] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00008224-00000C2B-1799129908] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00008224-00000C2B-1799248131] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00008224-00000C2B-1799297736] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll" [Source: 00000000-00008224-00000C2B-1799855104] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll" [Source: 00000000-00008224-00000C2B-1799892101] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00008224-00000C2B-1800274400]5a:T888,Spawned process "SaPub.exe" (UID: 00000000-00007604) Spawned process "h ?1?.exe" (UID: 00000000-00001168) Spawned process "Akfshnr_x86.exe" (UID: 00000000-00008224) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:Program ..." (UID: 00000000-00007576) Spawned process "cmd.exe" with commandline "/c wusa /uninstall /kb:890830 /quiet /norestart" (UID: 00000000-00006568) Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00006240) Spawned process "wusa.exe" with commandline "wusa /uninstall /kb:890830 /quiet /norestart" (UID: 00000000-00007272) Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00000568) Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00004936) Spawned process "sc.exe" with commandline "stop bits" (UID: 00000000-00004508) Spawned process "sc.exe" with commandline "stop dosvc" (UID: 00000000-00002196) Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-ac 0" (UID: 00000000-00003680) Spawned process "powercfg.exe" with commandline "/x -standby-timeout-ac 0" (UID: 00000000-00005064) Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-dc 0" (UID: 00000000-00009188) Spawned process "powercfg.exe" with commandline "/x -standby-timeout-dc 0" (UID: 00000000-00007900) Spawned process "sc.exe" with commandline "delete "GameSDK"" (UID: 00000000-00002300) Spawned process "sc.exe" with commandline "create "GameSDK" binpath= "%ALLUSERSPROFILE%\\GameSDKs" start= " ..." (UID: 00000000-00000924), Spawned process "sc.exe" with commandline "stop eventlog" (UID: 00000000-00001636), Spawned process "sc.exe" with commandline "start "GameSDK"" (UID: 00000000-00000284), Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00002164), Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00007304), Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00007624), Spawned process "sc.exe" with commandline "stop bits" (UID: 00000000-00007668), Spawned process "sc.exe" with commandline "stop dosvc" (UID: 00000000-00005960)5b:T888,Spawned process "SaPub.exe" (UID: 00000000-00007604) Spawned process "h ?1?.exe" (UID: 00000000-00001168) Spawned process "Akfshnr_x86.exe" (UID: 00000000-00008224) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:Program ..." (UID: 00000000-00007576) Spawned process "cmd.exe" with commandline "/c wusa /uninstall /kb:890830 /quiet /norestart" (UID: 00000000-00006568) Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00006240) Spawned process "wusa.exe" with commandline "wusa /uninstall /kb:890830 /quiet /norestart" (UID: 00000000-00007272) Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00000568) Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00004936) Spawned process "sc.exe" with commandline "stop bits" (UID: 00000000-00004508) Spawned process "sc.exe" with commandline "stop dosvc" (UID: 00000000-00002196) Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-ac 0" (UID: 00000000-00003680) Spawned process "powercfg.exe" with commandline "/x -standby-timeout-ac 0" (UID: 00000000-00005064) Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-dc 0" (UID: 00000000-00009188) Spawned process "powercfg.exe" with commandline "/x -standby-timeout-dc 0" (UID: 00000000-00007900) Spawned process "sc.exe" with commandline "delete "GameSDK"" (UID: 00000000-00002300) Spawned process "sc.exe" with commandline "create "GameSDK" binpath= "%ALLUSERSPROFILE%\\GameSDKs" start= " ..." (UID: 00000000-00000924), Spawned process "sc.exe" with commandline "stop eventlog" (UID: 00000000-00001636), Spawned process "sc.exe" with commandline "start "GameSDK"" (UID: 00000000-00000284), Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00002164), Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00007304), Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00007624), Spawned process "sc.exe" with commandline "stop bits" (UID: 00000000-00007668), Spawned process "sc.exe" with commandline "stop dosvc" (UID: 00000000-00005960)5c:T419,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\SaPub.exe" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\h (1).exe" "h ?1?.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\vzwf1d981e3j\Akfshnr_x86.exe" "Akfshnr_x86.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_frnvj022.k2u.ps1" "Akfshnr_x86.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_jlpbtglm.pnn.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_3jrwjjkn.ctu.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_nt3xnlnb.jiz.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_tj2yj0ud.wod.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_qyjb2coe.puu.psm1"5d:Ta43,"Akfshnr_x86.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%TEMP%\vzwf1d981e3j\Akfshnr_x86.exe]- [targetUID: 00000000-00001168] "msvcp140.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\x64dbg\msvcp140.dll]- [targetUID: 00000000-00006240] "h _1_.exe" has type "Unknown"- [targetUID: N/A] "x64dbg.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%ALLUSERSPROFILE%\x64dbg\x64dbg.exe]- [targetUID: 00000000-00008224] "__PSScriptPolicyTest_tj2yj0ud.wod.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_tj2yj0ud.wod.ps1]- [targetUID: 00000000-00007576] "GameSDKs" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- Location: [%ALLUSERSPROFILE%\GameSDKs]- [targetUID: 00000000-00007604] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00008224] "config" has type "ASCII text with very long lines (7000) with no line terminators"- Location: [%ALLUSERSPROFILE%\config]- [targetUID: 00000000-00008224] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007576] "SaPub.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- Location: [%TEMP%\SaPub.exe]- [targetUID: 00000000-00007604] "__PSScriptPolicyTest_3jrwjjkn.ctu.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_3jrwjjkn.ctu.ps1]- [targetUID: 00000000-00007576] "__PSScriptPolicyTest_t3tcznfx.xpj.ps1" has type "ASCII text with no line terminators"- [targetUID: N/A] "__PSScriptPolicyTest_frnvj022.k2u.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_frnvj022.k2u.ps1]- [targetUID: 00000000-00008224] "__PSScriptPolicyTest_qyjb2coe.puu.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_qyjb2coe.puu.psm1]- [targetUID: 00000000-00007576] "__PSScriptPolicyTest_nt3xnlnb.jiz.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_nt3xnlnb.jiz.psm1]- [targetUID: 00000000-00007576] "__PSScriptPolicyTest_jlpbtglm.pnn.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_jlpbtglm.pnn.psm1]- [targetUID: 00000000-00008224] "__PSScriptPolicyTest_tpf4dpn5.cnf.psm1" has type "ASCII text with no line terminators"- [targetUID: N/A]5e:T855,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CCG"; Key: ""; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\A92F2D3DC8CA44A3AA1BE1FDF21BFA19728E2394A9DC8F134D92FACDFD1107AF.EXE"; Key: ""; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "")5f:T420,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" queries basic process information of the "C:\a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (UID: 8688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\SaPub.exe" (UID: 8688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\h (1).exe" (UID: 8688) "SaPub.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\SaPub.exe" (UID: 7604) "h ?1?.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\h (1).exe" (UID: 1168) "h ?1?.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\vzwf1d981e3j\Akfshnr_x86.exe" (UID: 1168) "Akfshnr_x86.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\vzwf1d981e3j\Akfshnr_x86.exe" (UID: 8224)60:T1322,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}"; Key: "DATA"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-50D00E000000}"; Key: "GENERATION"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\INPROCSERVER32"; Key: ""; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32"; Key: ""; Value: "") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\PROPERTYBAG"; Key: "THISPCPOLICY"; Value: "")61:T4c3,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\ef4992f14ba62dc115c01e7a6018e263\mscorlib.ni.dll.aux" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\c20afd70aeb352395f8f5297a727f0ba\system.core.ni.dll.aux" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\67186481d97828a572bf5db055f4a9f1\system.ni.dll.aux" "SaPub.exe" reads file "c:\users\%osuser%\appdata\local\temp\sapub.exe" "Akfshnr_x86.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "Akfshnr_x86.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll.aux" "Akfshnr_x86.exe" reads file "c:\windows\microsoft.net\assembly\gac_msil\system.management.automation\v4.0_3.0.0.0__31bf3856ad364e35\system.management.automation.dll"62:T59f,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to touch file "C:\Windows\System32\wow64log.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to touch file "C:\WINDOWS\SysWOW64\MSCOREE.DLL" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to touch file "C:\WINDOWS\SysWOW64\apphelp.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to touch file "C:\a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb"63:T9fb,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\System32\wow64log.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\FLTLIB.DLL" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\MSVCP140.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\45cef8929f7918524d50f1f75c04b1c3\mscorlib.ni.dll" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\45cef8929f7918524d50f1f75c04b1c3\mscorlib.ni.dll"64:T727,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\MSCOREE.DLL.local" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe.config" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\OurNew" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.INI" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PublisherPolicy.tme" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\PROPSYS.dll.mui" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\SaPub.exe:Zone.Identifier" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\h (1).exe:Zone.Identifier" "Akfshnr_x86.exe" trying to access non-existent file "C:\Windows\System32\mscoree.dll.local" "Akfshnr_x86.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local"65:T7f3,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" writes file "c:\users\%osuser%\appdata\local\temp\sapub.exe" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" writes file "c:\users\%osuser%\appdata\local\temp\h (1).exe" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" writes file "%temp%\sapub.exe" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" writes file "%temp%\h (1).exe" "SaPub.exe" writes file "c:\programdata\gamesdks" "SaPub.exe" writes file "%allusersprofile%\gamesdks" "h ?1?.exe" writes file "c:\users\%osuser%\appdata\local\temp\vzwf1d981e3j\akfshnr_x86.exe" "h ?1?.exe" writes file "%temp%\vzwf1d981e3j\akfshnr_x86.exe" "Akfshnr_x86.exe" writes file "c:\programdata\x64dbg\msvcp140.dll" "Akfshnr_x86.exe" writes file "c:\programdata\x64dbg\x64dbg.exe" "Akfshnr_x86.exe" writes file "c:\programdata\config" "Akfshnr_x86.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_frnvj022.k2u.ps1" "Akfshnr_x86.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_jlpbtglm.pnn.psm1" "Akfshnr_x86.exe" writes file "%allusersprofile%\x64dbg\msvcp140.dll" "Akfshnr_x86.exe" writes file "%allusersprofile%\x64dbg\x64dbg.exe" "Akfshnr_x86.exe" writes file "%allusersprofile%\config" "Akfshnr_x86.exe" writes file "%temp%\__psscriptpolicytest_frnvj022.k2u.ps1" "Akfshnr_x86.exe" writes file "%temp%\__psscriptpolicytest_jlpbtglm.pnn.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_3jrwjjkn.ctu.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_nt3xnlnb.jiz.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_tj2yj0ud.wod.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_qyjb2coe.puu.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\moduleanalysiscache"66:T5e9,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe")67:T607,Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe")68:T57b,Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "lient Session TM: Connect callback received" (Indicator: " connect "; File: "AMSI") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp")69:T4545,Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;pj,rnld,rnnd,rn[e,rne,rne,rn" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007576.00000001.193168.70007000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;pj,rnld,rnnd,rn[e,rne,rne,rn" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20certificate%20list%20ca%202024.crl0pd0b0" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20certificate%20list%20ca%202024.crt0y" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://www.microsoft.com0h3y0w'q<@2/l:p" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn" - Source: "00000000-00007576.00000001.193168.72433000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007576.00000001.193168.72433000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00007576.00000001.193168.72433000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007576.00000001.193168.7246F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0dyd!0[p%0" - Source: "00000000-00007576.00000001.193168.7246F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0m$57wjuojhrnjhrnxkhrn\khrnnhrnxkhrng" - Source: "00000000-00007576.00000001.193168.7246F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0gv" - Source: "00000000-00007576.00000001.193168.7246F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0k26kvj>" - Source: "00000000-00007576.00000001.193168.7246F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0mpfa=" - Source: "00000000-00007576.00000001.193168.7246F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00007576.00000001.193168.7246F000.00000004.mdmp") Found URL "http://www.microsoft.com0u\dnq748.27z0washington1redmond1microsoft" - Source: "00000000-00007576.00000001.193168.7246F000.00000004.mdmp") Found URL "http://www.microsoft.com0=" - Source: "00000000-00007576.00000001.193168.7246F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl%200au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" - Source: "00000000-00007576.00000001.193168.7246F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp201%.micmicrosoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0]bbae" - Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt00_1t?lvbp)r" - Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0/b(lzu(v" - Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0a08." - Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/windows%20production%20pca%202023.crl0g[0y0wkhttp://www.microsoft.com/pkiops/certs/windows%20production%20pca%202023.crt0vd!7i6u4$i<-o_-!dq" - Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0!2eshttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0fg:smxsu$was.,k" - Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found URL "http://www.miocs/hp" - Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp")6a:T12f9,Found reference to API "915406870,9000,3024,,RtlGetVersion,NTDLL.dll,"00:49:18.765",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "917100776,9000,3025,,RtlGetNtProductType,NTDLL.dll,"00:49:18.781",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "917569700,9000,3024,,RtlGetVersion,NTDLL.dll,"00:49:18.781",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "0447380760,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0452183944,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0449408276,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0450941696,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0447572732,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0441268398,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0455405424,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0454438112,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0445735124,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0456535160,5152,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0436916726,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.953",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0453531684,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0433289440,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.953",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "0451975226,5280,3024,,RtlGetVersion,NTDLL.dll,"00:49:53.968",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp") Found reference to API "8644789346,9120,3024,,RtlGetVersion,NTDLL.dll,"00:50:18.218",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found reference to API "8645058902,9120,3024,,RtlGetVersion,NTDLL.dll,"00:50:18.218",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found reference to API "8645187330,9120,3024,,RtlGetVersion,NTDLL.dll,"00:50:18.218",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found reference to API "8577085594,5520,3024,,RtlGetVersion,NTDLL.dll,"00:50:18.187",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found reference to API "8576828116,5520,3024,,RtlGetVersion,NTDLL.dll,"00:50:18.187",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found reference to API "8575834348,6600,3024,,RtlGetVersion,NTDLL.dll,"00:50:18.187",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found reference to API "7182664812,7976,3024,,RtlGetVersion,NTDLL.dll,"00:50:17.609",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found reference to API "8576558826,5520,3024,,RtlGetVersion,NTDLL.dll,"00:50:18.187",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00007576.00000001.193168.72542000.00000004.mdmp")6b:Teac,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00008688) "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00008688)6c:T128c,Found string "romBase64String" (Indicator: "base64"; File: "AMSI") Found string "oBase64String" (Indicator: "base64"; File: "AMSI") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007576.00000000.191615.72290000.00000004.mdmp, 00000000-00007576.00000001.193168.72290000.00000004.mdmp, 00000000-00007576.00000001.193168.7246F000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00007576.00000001.193168.70007000.00000004.mdmp, 00000000-00007576.00000001.193168.72290000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007576.00000001.193168.70007000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007576.00000001.193168.F8B10000.00000004.mdmp, 00000000-00007576.00000001.193168.F8B30000.00000004.mdmp, 00000000-00007576.00000001.193168.F8B50000.00000004.mdmp, 00000000-00007576.00000001.193168.F8B60000.00000004.mdmp, 00000000-00007576.00000001.193168.F8B80000.00000004.mdmp, 00000000-00007576.00000001.193168.F8BA0000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00007576.00000001.193168.F8B10000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007576.00000001.193168.F8B10000.00000004.mdmp, 00000000-00007576.00000001.193168.F8B30000.00000004.mdmp, 00000000-00007576.00000001.193168.F8B50000.00000004.mdmp, 00000000-00007576.00000001.193168.F8B60000.00000004.mdmp, 00000000-00007576.00000001.193168.F8B80000.00000004.mdmp, 00000000-00007576.00000001.193168.F8BA0000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "rijndael"; Source: "00000000-00007576.00000001.193168.F8B10000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "Rijndaelmanaged"; Source: "00000000-00007576.00000001.193168.F8B10000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00007576.00000001.193168.F8B10000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00007576.00000001.193168.F8B30000.00000004.mdmp") Found string "frombase64transform" (Indicator: "base64"; Source: "00000000-00007576.00000001.193168.F8B30000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00007576.00000001.193168.F8B30000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00007576.00000001.193168.F8B30000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00007576.00000001.193168.F8B30000.00000004.mdmp")6d:T106d,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "779085348,4616,3125,,Process32NextW,kernel32.dll,"00:49:18.718",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "775499286,4616,3125,,Process32NextW,kernel32.dll,"00:49:18.718",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "768346008,4616,3125,,Process32NextW,kernel32.dll,"00:49:18.718",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "767904648,4616,3125,,Process32NextW,kernel32.dll,"00:49:18.718",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "774162518,4616,3125,,Process32NextW,kernel32.dll,"00:49:18.718",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "772846360,4616,3125,,Process32NextW,kernel32.dll,"00:49:18.718",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "780572708,4616,3125,,Process32NextW,kernel32.dll,"00:49:18.718",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "774635442,4616,3125,,Process32NextW,kernel32.dll,"00:49:18.718",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "780055792,4616,3125,,Process32NextW,kernel32.dll,"00:49:18.718",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "776438528,4616,3125,,Process32NextW,kernel32.dll,"00:49:18.718",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002196.00000000.194802.2503B000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp")6e:T4cc,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001168.00000000.189609.009FF000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00007576.00000001.193168.595AB000.00000002.mdmp")6f:T1822,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00000568.00000000.193823.B41D0000.00000004.mdmp, 00000000-00000568.00000000.193823.B4230000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00000568.00000000.193823.B41D0000.00000004.mdmp, 00000000-00000568.00000000.193823.B4230000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00000568.00000000.193823.B4230000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00000924.00000000.195455.0BDB0000.00000004.mdmp, 00000000-00000924.00000000.195455.0BDF0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00000924.00000000.195455.0BDB0000.00000004.mdmp, 00000000-00000924.00000000.195455.0BDF0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00000924.00000000.195455.0BDF0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp, 00000000-00001168.00000000.189609.E0B50000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp, 00000000-00001168.00000000.189609.E0B50000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\h (1).exe" (Indicator: "\Device\"; Source: "00000000-00001168.00000000.189609.E0890000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002196.00000000.194802.207A0000.00000004.mdmp, 00000000-00002196.00000000.194802.20A00000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002196.00000000.194802.207A0000.00000004.mdmp, 00000000-00002196.00000000.194802.20A00000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00002196.00000000.194802.207A0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002300.00000000.195132.7D930000.00000004.mdmp, 00000000-00002300.00000000.195132.7DC80000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002300.00000000.195132.7D930000.00000004.mdmp, 00000000-00002300.00000000.195132.7DC80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00002300.00000000.195132.7D930000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004508.00000000.194478.31D40000.00000004.mdmp, 00000000-00004508.00000000.194478.32030000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004508.00000000.194478.31D40000.00000004.mdmp, 00000000-00004508.00000000.194478.32030000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00004508.00000000.194478.31D40000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004936.00000000.194154.8ED90000.00000004.mdmp, 00000000-00004936.00000000.194154.8F010000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004936.00000000.194154.8ED90000.00000004.mdmp, 00000000-00004936.00000000.194154.8F010000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00004936.00000000.194154.8ED90000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006240.00000000.193500.4CEE0000.00000004.mdmp, 00000000-00006240.00000000.193500.4D120000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006240.00000000.193500.4CEE0000.00000004.mdmp, 00000000-00006240.00000000.193500.4D120000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sc.exe" (Indicator: "\Device\"; Source: "00000000-00006240.00000000.193500.4CEE0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp, 00000000-00007576.00000000.191615.701E0000.00000004.mdmp, 00000000-00007576.00000000.191615.71B20000.00000004.mdmp, 00000000-00007576.00000001.193168.6FFE0000.00000004.mdmp, 00000000-00007576.00000001.193168.701E0000.00000004.mdmp, 00000000-00007576.00000001.193168.72362000.00000004.mdmp, 00000000-00007576.00000001.193168.72433000.00000004.mdmp, 00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp, 00000000-00007576.00000000.191615.701E0000.00000004.mdmp, 00000000-00007576.00000000.191615.71B20000.00000004.mdmp, 00000000-00007576.00000001.193168.6FFE0000.00000004.mdmp, 00000000-00007576.00000001.193168.701E0000.00000004.mdmp, 00000000-00007576.00000001.193168.72362000.00000004.mdmp, 00000000-00007576.00000001.193168.72433000.00000004.mdmp, 00000000-00007576.00000001.193168.72542000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp, 00000000-00007576.00000001.193168.6FFE0000.00000004.mdmp")70:T8bb,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\H (1).EXE"; Value: ""), "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: ""), "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\SAPUB.EXE"; Value: ""), "SaPub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: ""), "SaPub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: ""), "SaPub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\SC.EXE"; Value: ""), "SaPub.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\POWERCFG.EXE"; Value: ""), "h ?1?.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\VZWF1D981E3J\AKFSHNR_X86.EXE"; Value: ""), "Akfshnr_x86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: ""), "Akfshnr_x86.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")71:Te05,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "F201000000000000040004000102100000000000770000000D787900020000002A0AE302020000002F92E302020000005990030302000000648C0303010000006B507E00020000008509E3020600000087DE83000100000090A6A10102000000917003033C000000A19F5E0002000000D66F030301000000DBB4EF0002000000EC8C030301000000EEAAD50202000000FED37A0005000100000001000000187DC7005400000056737D00070000006B507E00010000009829B70007000000E6C531000800040000006C0000001A9CB20002000000370AE3020100000092D7B8020100000099D7B80202000000AF90030301000000BC44AA0201000000DAD87E0002000000EFBA8302010005000000010000009FC8CA0002006400000001000000421D0B0102000000461D0B0103006500000001000000779B9300AA100000E6C5310012000000F0E0B60001006600000001000000779B930001006800000001000000BC6EB40001007D0000000100000065A69E0001007F0000000100000065A69E0000") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "SaPub.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "701240B4ED70DD010000000000000000000000000200000000") "SaPub.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MRT"; Key: "DONTOFFERTHROUGHWUAU"; Value: "0100000000") "Akfshnr_x86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "Akfshnr_x86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "Akfshnr_x86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "Akfshnr_x86.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000")72:T635,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" reads file "C:\Users\desktop.ini"73:T961,"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" wrote 38912 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\SaPub.exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0800 ... "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" wrote 43520 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\h (1).exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SaPub.exe" wrote 38912 bytes starting with PE header signature to file "C:\ProgramData\GameSDKs": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0800 ... "h ?1?.exe" wrote 65029 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\vzwf1d981e3j\Akfshnr_x86.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Akfshnr_x86.exe" wrote 47616 bytes starting with PE header signature to file "C:\ProgramData\x64dbg\msvcp140.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Akfshnr_x86.exe" wrote 2048 bytes starting with PE header signature to file "C:\ProgramData\x64dbg\x64dbg.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000180100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...74:T91d,Spawned process "a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe" (UID: 00000000-00008688) Spawned process "SaPub.exe" (UID: 00000000-00007604) Spawned process "h ?1?.exe" (UID: 00000000-00001168) Spawned process "Akfshnr_x86.exe" (UID: 00000000-00008224) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force" (UID: 00000000-00007576) Spawned process "cmd.exe" with commandline "/c wusa /uninstall /kb:890830 /quiet /norestart" (UID: 00000000-00006568) Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00006240) Spawned process "wusa.exe" with commandline "wusa /uninstall /kb:890830 /quiet /norestart" (UID: 00000000-00007272) Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00000568) Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00004936) Spawned process "sc.exe" with commandline "stop bits" (UID: 00000000-00004508) Spawned process "sc.exe" with commandline "stop dosvc" (UID: 00000000-00002196) Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-ac 0" (UID: 00000000-00003680) Spawned process "powercfg.exe" with commandline "/x -standby-timeout-ac 0" (UID: 00000000-00005064) Spawned process "powercfg.exe" with commandline "/x -hibernate-timeout-dc 0" (UID: 00000000-00009188) Spawned process "powercfg.exe" with commandline "/x -standby-timeout-dc 0" (UID: 00000000-00007900) Spawned process "sc.exe" with commandline "delete "GameSDK"" (UID: 00000000-00002300) Spawned process "sc.exe" with commandline "create "GameSDK" binpath= "%ALLUSERSPROFILE%\\GameSDKs" start= "auto"" (UID: 00000000-00000924) Spawned process "sc.exe" with commandline "stop eventlog" (UID: 00000000-00001636) Spawned process "sc.exe" with commandline "start "GameSDK"" (UID: 00000000-00000284) Spawned process "sc.exe" with commandline "stop UsoSvc" (UID: 00000000-00002164) Spawned process "sc.exe" with commandline "stop WaaSMedicSvc" (UID: 00000000-00007304) Spawned process "sc.exe" with commandline "stop wuauserv" (UID: 00000000-00007624) Spawned process "sc.exe" with commandline "stop bits" (UID: 00000000-00007668) Spawned process "sc.exe" with commandline "stop dosvc" (UID: 00000000-00005960)30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794299528041,"unified_at":"2026-11-10T08:32:08.041Z","metadata":{"hashes":{"sha256":"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","sha1":"168792b0c49fb5d6ae6125a2fbe0ea170bce4801","md5":"14013e5f8ce2e4a9459b669368c37786","sha512":"e0dba8581f47d14e7ef8383fa23370a6f810cb0687d7450c4ffb69ff8fad1ccaedca79faa70a1b0af559dde4b025052a2ec802e7d648c6a3315d60a83096ead6","ssdeep":"98304:wSWoElNFXHS6TmXMdSp2zge1TmyEv7/cAynU5gXjYtFULgW/DKe:wSWFBXRTmXSnTTE4AL57tybDKe","ssdeep_chunks":["98304:wSWoElN","98304:SWoElNF","98304:WoElNFX","98304:oElNFXH","98304:ElNFXHS","98304:lNFXHS6","98304:NFXHS6T","98304:FXHS6Tm","98304:XHS6TmX","98304:HS6TmXM","98304:S6TmXMd","98304:6TmXMdS","98304:TmXMdSp","98304:mXMdSp2","98304:XMdSp2z","98304:MdSp2zg","98304:dSp2zge","98304:Sp2zge1","98304:p2zge1T","98304:2zge1Tm","98304:zge1Tmy","98304:ge1TmyE","98304:e1TmyEv","98304:1TmyEv7","98304:TmyEv7/","98304:myEv7/c","98304:yEv7/cA","98304:Ev7/cAy","98304:v7/cAyn","98304:7/cAynU","98304:/cAynU5","98304:cAynU5g","98304:AynU5gX","98304:ynU5gXj","98304:nU5gXjY","98304:U5gXjYt","98304:5gXjYtF","98304:gXjYtFU","98304:XjYtFUL","98304:jYtFULg","98304:YtFULgW","98304:tFULgW/","98304:FULgW/D","98304:ULgW/DK","98304:LgW/DKe","196608:wSWoElN","196608:SWoElNF","196608:WoElNFX","196608:oElNFXH","196608:ElNFXHS","196608:lNFXHS6","196608:NFXHS6T","196608:FXHS6Tm","196608:XHS6TmX","196608:HS6TmXM","196608:S6TmXMd","196608:6TmXMdS","196608:TmXMdSp","196608:mXMdSp2","196608:XMdSp2z","196608:MdSp2zg","196608:dSp2zge","196608:Sp2zge1","196608:p2zge1T","196608:2zge1Tm","196608:zge1Tmy","196608:ge1TmyE","196608:e1TmyEv","196608:1TmyEv7","196608:TmyEv7/","196608:myEv7/c","196608:yEv7/cA","196608:Ev7/cAy","196608:v7/cAyn","196608:7/cAynU","196608:/cAynU5","196608:cAynU5g","196608:AynU5gX","196608:ynU5gXj","196608:nU5gXjY","196608:U5gXjYt","196608:5gXjYtF","196608:gXjYtFU","196608:XjYtFUL","196608:jYtFULg","196608:YtFULgW","196608:tFULgW/","196608:FULgW/D","196608:ULgW/DK","196608:LgW/DKe","98304:wSWFBXR","98304:SWFBXRT","98304:WFBXRTm","98304:FBXRTmX","98304:BXRTmXS","98304:XRTmXSn","98304:RTmXSnT","98304:TmXSnTT","98304:mXSnTTE","98304:XSnTTE4","98304:SnTTE4A","98304:nTTE4AL","98304:TTE4AL5","98304:TE4AL57","98304:E4AL57t","98304:4AL57ty","98304:AL57tyb","98304:L57tybD","98304:57tybDK","98304:7tybDKe"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"OurNew.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":6777856,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794293713000,"last_seen":1794299102000,"last_multi_scan":1794299102000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["mokes","evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":99},"sandbox_signatures":{"informative_count":241,"suspicious_count":12,"malicious_count":15,"total":268},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Mokes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"IL:Trojan.Downloader.4973","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"IL:Trojan.Downloader.4973 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.UZA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"VirTool/MSIL.Obfuscator.su","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005a8b921 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/ILAgent-I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"GenericRXOO-YN!14013E5F8CE2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.FFY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"IL:Trojan.Downloader","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"informative","value":"May contain SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Execution","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"Contains reference to transaction activity (Powershell command string)"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to add modules to the current session (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"malicious","value":"Starts service using SC.exe"},{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Able to access control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Able to detect if debugger is present"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate available system drives (PowerShell command string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"},{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":".NET code is able to query registry"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"malicious","value":"Stops or deletes service using sc.exe"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to load content from resource"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Contains ability to load CLR runtime module (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Defense Impairment","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"Found reference to API \"}9\\\taDUP!\" (Indicator: \"dup\"; Source: \"sample.bin\"), Found reference to API \"Select * from Win32_ComputerSystem\" (Indicator: \"select\"; Source: \"sample.bin\"), Found reference to API \"N6iA\\\taDUP!\" (Indicator: \"dup\"; Source: \"sample.bin\"), Found reference to API \"lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\" (Indicator: \"read\"; Source: \"sample.bin\"), Found reference to API \"lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\" (Indicator: \"time\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: sample.bin, Indicator: \"select * from win32_computersystem\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"sv.pvv/qmzg*n\", Heuristic match: \"f+z.gf\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"SbieDll.dll\" (Indicator: \"sbiedll.dll\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$36","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$37","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force\" (Indicator: \"add-mppreference\"; File: \"AMSI\")\n Found reference string \"C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force\" (Indicator: \"add-mppreference\"; Source: \"00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp, 00000000-00007576.00000001.193168.6FFE0000.00000004.mdmp\")\n Found reference string \"HostApplication=C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force\" (Indicator: \"add-mppreference\"; Source: \"00000000-00007576.00000001.193168.70007000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load CLR runtime module (Dotnet)","description":"Observed imported APIs from \"mscoree.dll\" : \"CLRCreateInstance\" [Source: msvcp140.dll]","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-170","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")\n Found string \"on_objectModelWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpRollback.cdxml-Help.xml}Microsoft.PowerShell.Core\\Export-ModuleMember -Function 'Start-MpRollback' -Alias '*'\" (Indicator: \"Export-ModuleMember\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")\n Found reference to API \"EnumQueryServicesStatus:OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")\n Found reference to API \"StartService: OpenService\" (Indicator: \"OpenService\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007576.00000001.193168.72290000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe has big resource with name: \"h (1)\" size: \"4106752\" and abnormal entropy:\"7.995721418669729\"\n a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe has big resource with name: \"SaPub\" size: \"2660352\" and abnormal entropy:\"7.0084155877278755\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\pipe\\; Source: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$3d","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Able to detect if debugger is present","description":"Observed API \"CheckRemoteDebuggerPresent\" in \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"","origin":"Static Parser","mitre_attack_id":"T1622","relevance":1,"id":"static-220","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00007576.00000001.193168.F8B30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$3f","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinary: Hex data string to binary conversion\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007576.00000001.193168.F8B30000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007576.00000001.193168.F8BE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$42","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007576.00000001.193168.72290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.87196","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$43","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$44","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate available system drives (PowerShell command string)","description":"file/memory contains long string with (Indicator: \"Get-PSDrive\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":1,"id":"string-997","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008224-00000C2C-1801788136\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008224-00000C2C-1802204963\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameExA\" (Source: \"00000000-00007576.00000001.193168.72290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008224-00000C2C-1801788136\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008224-00000C2C-1802204963\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"x64dbg.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00008688-00000C2C-1792547210\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00008688-00000C2C-1792547896\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00008224-00000C2C-1802214500\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00008224-00000C2C-1802214550\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"\n Found system information discovery API: \"GetSystemInfo\" in file \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00007576-00000C2C-1831676323\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00007576-00000C2C-1831676379\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00008688)\n \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00008688)\n \"h ?1?.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001168)\n \"Akfshnr_x86.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00008224)\n \"Akfshnr_x86.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00008224)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00008688)\n \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00008688)\n \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00008688)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008688)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"GetForegroundWindow\" (UID: 00000000-00008688)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"IsWow64Process\" with parameter \"8688\" - (UID: 00000000-00008688)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"EnumWindows\" with parameter \"90369512\" - (UID: 00000000-00008688)\n \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"EnumWindows\" with parameter \"101444216\" - (UID: 00000000-00008688)\n \"h ?1?.exe\" called \"EnumWindows\" with parameter \"778238426376\" - (UID: 00000000-00001168)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007576)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008688)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$46","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"Akfshnr_x86.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f023000002000000007f0000000000000000000001000000000000004026b07df87f000000010000000000003826b07df87f00000000000000000000409dfa82f87f000000000000000000000001000000000000701fda80f87f00000000af7df87f000001000000000000002f19af7df87f000000000000000000003826b07df87f0000fc72f11f (UID: 00000000-00008224)\n \"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000654a000002000000007f0000000000000000000001000000000000004026ae7df87f000000010000000000003826ae7df87f00000000000000000000409dfa82f87f000000000000000000000001000000000000701fda80f87f00000000ad7df87f000001000000000000002f19ad7df87f000000000000000000003826ae7df87f000000d01500 (UID: 00000000-00007576)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"Akfshnr_x86.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00008224)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007576)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00008688)\n \"Akfshnr_x86.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00008224)\n \"Akfshnr_x86.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00008224)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007576)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007576)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: msvcp140.dll]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$47","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" queried token user identity (UID: 00000000-00008688)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$49","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Akfshnr_x86.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Akfshnr_x86.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\H (1).EXE\"), \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SAPUB.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"processstartinfo\" (Source: \"00000000-00007576.00000001.193168.F8B60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"x64dbg.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"Akfshnr_x86.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00008224)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007576)","origin":"API Call","mitre_attack_id":"T1685","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"h ?1?.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\vzwf1d981e3j (UID: 00000000-00001168)\n \"Akfshnr_x86.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\x64dbg (UID: 00000000-00008224)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\SaPub.exe\"\" - (UID: 00000000-00008688)\n \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\h (1).exe\"\" - (UID: 00000000-00008688)\n \"h ?1?.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\vzwf1d981e3j\\Akfshnr_x86.exe\" - (UID: 00000000-00001168)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"wusa /uninstall /kb:890830 /quiet /norestart\" - (UID: 00000000-00006568)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Akfshnr_x86.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134387727938854674.8224.PowerChell.Akfshnr_x86\" - (UID: 00000000-00008224)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134387728242729268.7576.DefaultAppDomain.powershell\" - (UID: 00000000-00007576)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$4c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$4d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to add modules to the current session (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Import-Module\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-348","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"annotCreateProcessInContainer\" (Indicator: \"CreateProcess\"; File: \"AMSI\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"919093116,9000,3142,,CreateProcessA,kernel32.dll,\"00:49:18.781\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001168.00000000.189609.E0890000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"opyItemRemotelyFailedToCreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"AMSI\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"nableToCreateFileHash\" (Indicator: \"CreateFile\"; File: \"AMSI\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: msvcp140.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"ouldNotAutoLoadModule\" (Indicator: \"LoadModule\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"file/memory contains long string with (Indicator: \"ShowWindow\"; File: \"AMSI\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.get_StartInfo\" in \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"\n Observed function \"Process.Start\" in \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartService: OpenService\" (Indicator: \"StartService\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")\n Found reference to API \"StartService\" (Indicator: \"StartService\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")\n Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"msvcp140.dll\" contains export function called \"Start\" at ordinal 1\n \"x64dbg.exe\" contains export function called \"LoadLibraryCheckedA\" at ordinal 1\n \"x64dbg.exe\" contains export function called \"LoadLibraryCheckedW\" at ordinal 2","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$50","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$51","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"x64dbg.exe\" as clean (type is \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections\"), Antivirus vendors marked dropped file \"__PSScriptPolicyTest_tj2yj0ud.wod.ps1\" as clean (type is \"ASCII text with no line terminators\"), Antivirus vendors marked dropped file \"__PSScriptPolicyTest_3jrwjjkn.ctu.ps1\" as clean (type is \"ASCII text with no line terminators\"), Antivirus vendors marked dropped file \"__PSScriptPolicyTest_t3tcznfx.xpj.ps1\" as clean (type is \"ASCII text with no line terminators\"), Antivirus vendors marked dropped file \"__PSScriptPolicyTest_frnvj022.k2u.ps1\" as clean (type is \"ASCII text with no line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force\" (UID: 00000000-00007576)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$52","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"msvcp140.dll\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"x64dbg.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"GameSDKs\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"GetModuleHandle\" in \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"\n Observed unmanaged function \"CheckRemoteDebuggerPresent\" in \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134387727938854674.8224.PowerChell.Akfshnr_x86\n Found string - \\.\\pipe\\\n Found string - \\\\.\\pipe\\PSHost.134387728242729268.7576.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$53","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"Akfshnr_x86.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 81BE0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$54","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\ef4992f14ba62dc115c01e7a6018e263\\mscorlib.ni.dll\" at 72D00000\n \"Akfshnr_x86.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at 56890000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at 56890000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"Akfshnr_x86.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 71A50000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 71A50000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$55","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 74230000\n \"Akfshnr_x86.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 57EF0000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 57EF0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76270000\n \"SaPub.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81240000\n \"h ?1?.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81240000\n \"Akfshnr_x86.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81240000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81240000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81240000\n \"sc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81240000\n \"wusa.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81240000\n \"powercfg.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 81240000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a39380f87f0000@ntdll.dll\"\n \"220023000000000038a39380f87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" was detected as \".NET\" and name: \"Library\"\n \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"msvcp140.dll\" was detected as \".NET\" and name: \"Library\"\n \"msvcp140.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"x64dbg.exe\" was detected as \".NET\" and name: \"Library\"\n \"x64dbg.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"GameSDKs\" was detected as \".NET\" and name: \"Library\"\n \"GameSDKs\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"Split-Path\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Test-Path\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Resolve-Path\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$56","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"msvcp140.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"x64dbg.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" has an executable section named \".text\"\n \"msvcp140.dll\" has an executable section named \".text\"\n \"x64dbg.exe\" has an executable section named \".text\"\n \"GameSDKs\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"msvcp140.dll\" has an writable section named \".data\"\n \"msvcp140.dll\" has an writable section named \".fptable\"\n \"x64dbg.exe\" has an writable section named \".data\"\n \"x64dbg.exe\" has an writable section named \".fptable\"\n \"GameSDKs\" has an writable section named \".data\"\n \"GameSDKs\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$57","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x676200\" greater than 0x100000\n Raw size of \".text\" is \"0x326a00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x132000\" greater than 0x100000\n Raw size of \".data\" is \"0x27d200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x676034\" greater than 0x100000\n Virtual size of \".text\" is \"0x3269e0\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x131e2a\" greater than 0x100000\n Virtual size of \".data\" is \"0x27e470\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"msvcp140.dll\" has high imagebase \"0x180000000\"\n \"x64dbg.exe\" has high imagebase \"0x140000000\"\n \"GameSDKs\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00007604-00000BC0-1827446050]\n Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00007604-00000BC0-1856826705]\n Observed system executable string:\"%WINDIR%\\System32\\sc.exe\" [Source: 00000000-00007604-00000BC0-1856848106]\n Observed system executable string:\"%WINDIR%\\System32\\powercfg.exe\" [Source: 00000000-00007604-00000BC0-1882302445]\n Observed system executable string:\"%WINDIR%\\System32\\wusa.exe\" [Source: 00000000-00006568-00000BC0-1858420790]\n Observed system executable string:\"%WINDIR%\\system32\\wusa.exe\" [Source: 00000000-00006568-00000C47-2519870450]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"SaPub.exe\" (UID: 00000000-00007604) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"SaPub.exe\" (UID: 00000000-00007604) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"Akfshnr_x86.exe\" (UID: 00000000-00008224) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"Akfshnr_x86.exe\" (UID: 00000000-00008224) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"wusa.exe\" (UID: 00000000-00007272) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"sc.exe\" (UID: 00000000-00000568) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"Akfshnr_x86.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$58","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$5a","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$5b","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"$5c","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")\n Found reference to API \"RtlCreateServiceSid\" (Indicator: \"CreateService\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")\n Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"New-Event\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"h ?1?.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"Akfshnr_x86.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"Akfshnr_x86.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"Akfshnr_x86.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"Akfshnr_x86.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"Akfshnr_x86.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$5d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"msvcp140.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections\"- Location: [%ALLUSERSPROFILE%\\x64dbg\\msvcp140.dll]- [targetUID: 00000000-00006240]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$5f","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$60","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$62","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"Akfshnr_x86.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"Akfshnr_x86.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\profile.ps1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WindowsPowerShell\\profile.ps1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$63","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$64","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$65","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00007576.00000001.193168.F8B60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"annotCreatePipeline\" (Indicator: \"CreatePipe\"; File: \"AMSI\")\n Found reference to API \"annotCreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$69","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"msvcp140.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE7CA4ACE82D3DB9284E4F3872D79A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp, 00000000-00007576.00000001.193168.70007000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE6179882FB5DEF50D23BC4C1372AB]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007576.00000001.193168.70007000.00000004.mdmp, 00000000-00007576.00000001.193168.725F9000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007576.00000001.193168.7246F000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE6179882FB5DEF50D23BC4C1372AB]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007576.00000001.193168.72542000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"lientKerberosDisabled\" (Indicator: \"kerberos\"; File: \"AMSI\")\n Found string \"orkgroupCannotUseKerberos\" (Indicator: \"kerberos\"; File: \"AMSI\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00007576.00000001.193168.F8B60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: msvcp140.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: x64dbg.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$6b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"SaPub.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"h ?1?.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"h ?1?.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"Akfshnr_x86.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"sc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"Akfshnr_x86.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00008224)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007576)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"Akfshnr_x86.exe\" called \"GetComputerNameW\" (UID: 00000000-00008224)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007576)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}\n \"Akfshnr_x86.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"Akfshnr_x86.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"Akfshnr_x86.exe\" called \"GetUserNameW\" (UID: 00000000-00008224)\n \"Akfshnr_x86.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007576)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Where-Object\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Select-Object\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Item \"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Get-PSProvider\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Get-Content\"; File: \"AMSI\")\n Found string \"efault Get-Command Action\" (Indicator: \"Get-Command\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Get-Help\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Get-Member\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"6230327994,5188,3147,,GetComputerNameW,kernel32.dll,\"00:50:08.875\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007576.00000001.193168.72433000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001168.00000000.189609.009F4000.00000002.mdmp, 00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password=\" (Indicator: \"password\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")\n Found string \"passwordbasedencryption\" (Indicator: \"password\"; Source: \"00000000-00007576.00000001.193168.F8B10000.00000004.mdmp\")\n Found string \"passwordderivebytes\" (Indicator: \"password\"; Source: \"00000000-00007576.00000001.193168.F8B30000.00000004.mdmp\")\n Found string \"sha1fornonsecretpurposes\" (Indicator: \"secret\"; Source: \"00000000-00007576.00000001.193168.F8B50000.00000004.mdmp\")\n Found string \"passwordpropertytextattribute\" (Indicator: \"password\"; Source: \"00000000-00007576.00000001.193168.F8B60000.00000004.mdmp\")\n Found string \"secretagreementflags\" (Indicator: \"secret\"; Source: \"00000000-00007576.00000001.193168.F8B80000.00000004.mdmp\")\n Found string \"safencryptsecrethandle\" (Indicator: \"secret\"; Source: \"00000000-00007576.00000001.193168.F8B80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00007576.00000001.193168.F8B60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"System.ServiceProcess.ServiceController\" (Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Akfshnr_x86.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008224)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007576)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"xportConsoleCannotDeleteFile\" (Indicator: \"DeleteFile\"; File: \"AMSI\")\n Found reference to API \"csCannotDeleteFile\" (Indicator: \"DeleteFile\"; File: \"AMSI\")\n Found reference to API \"csCannotDeleteFileAfterInstall\" (Indicator: \"DeleteFile\"; File: \"AMSI\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableBehaviorMonitoring\" (Indicator: \"disablebehaviormonitoring\"; Source: \"00000000-00007576.00000001.193168.72542000.00000004.mdmp\")\n Found string \"DisableIntrusionPreventionSystem\" (Indicator: \"disableintrusionpreventionsystem\"; Source: \"00000000-00007576.00000001.193168.72542000.00000004.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00007576.00000001.193168.72542000.00000004.mdmp\")\n Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00007576.00000001.193168.72542000.00000004.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00007576.00000001.193168.72542000.00000004.mdmp\")\n Found string \"DisableBlockAtFirstSeen\" (Indicator: \"disableblockatfirstseen\"; Source: \"00000000-00007576.00000001.193168.72542000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilegej\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00007576.00000000.191615.6FFE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"GetSecurityDescriptorControl\" (Indicator: \"GetSecurityDescriptorControl\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\")\n Found reference to API \"annotTerminateProcessInContainer\" (Indicator: \"TerminateProcess\"; File: \"AMSI\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001168.00000000.189609.009FF000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002196.00000000.194802.2503B000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007576.00000001.193168.595AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"SaPub.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"701240B4ED70DD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"May contain SSL certificate","description":"\"----BEGIN CERTIFICATE-----\" (Indicator: \"----begin certificate----\") in Source: AMSI","origin":"File/Memory","mitre_attack_id":"T1588.004","relevance":1,"id":"string-574","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" opened \"\\Device\\KsecDD\"\n \"SaPub.exe\" opened \"\\Device\\KsecDD\"\n \"h ?1?.exe\" opened \"\\Device\\KsecDD\"\n \"Akfshnr_x86.exe\" opened \"\\Device\\KsecDD\"\n \"cmd.exe\" opened \"\\Device\\KsecDD\"\n \"sc.exe\" opened \"\\Device\\KsecDD\"\n \"wusa.exe\" opened \"\\Device\\KsecDD\"\n \"powercfg.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$70","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force\" (UID: 00000000-00007576)","origin":"Monitored Target","mitre_attack_id":"T1685","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$71","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n file/memory contains long string with (Indicator: \"Set-MpPreference\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to transaction activity (Powershell command string)","description":"Found string \"Start-Transaction\" (Indicator: \"Start-Transaction\"; File: \"AMSI\")\n Found string \"Use-Transaction\" (Indicator: \"Use-Transaction\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-376","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Akfshnr_x86.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections\"- Location: [%TEMP%\\vzwf1d981e3j\\Akfshnr_x86.exe]- [targetUID: 00000000-00001168]\n \"SaPub.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections\"- Location: [%TEMP%\\SaPub.exe]- [targetUID: 00000000-00007604]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"ModuleAnalysisCache\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00008224]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007576]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"1019327324,4616,9,$name,2,0,,\"RuntimeBroker.exe\"\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" has section name .text with entropy \"7.872295813293408\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/26 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"x64dbg.exe\" has resource with unusual entropy \"RT_ICON:7.87573447313647\"\n \"x64dbg.exe\" has resource with unusual entropy \"RT_ICON:7.915277414088869\"\n \"x64dbg.exe\" has resource with unusual entropy \"RT_ICON:7.933238621120694\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$72","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Akfshnr_x86.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections\"- Location: [%TEMP%\\vzwf1d981e3j\\Akfshnr_x86.exe]- [targetUID: 00000000-00001168]\n \"msvcp140.dll\" has type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections\"- Location: [%ALLUSERSPROFILE%\\x64dbg\\msvcp140.dll]- [targetUID: 00000000-00006240]\n \"x64dbg.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections\"- Location: [%ALLUSERSPROFILE%\\x64dbg\\x64dbg.exe]- [targetUID: 00000000-00008224]\n \"GameSDKs\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections\"- Location: [%ALLUSERSPROFILE%\\GameSDKs]- [targetUID: 00000000-00007604]\n \"SaPub.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections\"- Location: [%TEMP%\\SaPub.exe]- [targetUID: 00000000-00007604]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$73","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"SaPub.exe\" marked \"C:\\Windows\\System32\\MRT.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"SaPub.exe\" opened \"C:\\Windows\\System32\\MRT.exe\" with delete access\n \"Akfshnr_x86.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_frnvj022.k2u.ps1\" with delete access\n \"Akfshnr_x86.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_jlpbtglm.pnn.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_tj2yj0ud.wod.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qyjb2coe.puu.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"Akfshnr_x86.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"WriteFile\n GetStartupInfoW\n LoadLibraryW\n GetCommandLineA\n Sleep\n FindFirstFileExW\n GetFileAttributesExW\n CreateThread\n GetProcAddress\n IsDebuggerPresent\n GetModuleFileNameW\n LoadLibraryExW\n FindNextFileW\n GetModuleHandleW\n LoadLibraryA\n ExitThread\n GetSystemDirectoryA\n VirtualProtectEx\n GetFileSizeEx\n TerminateProcess\n FindFirstFileW\n GetTickCount64\n GetCommandLineW\n GetModuleHandleExW\n CreateFileW\n SleepConditionVariableSRW\n UnhandledExceptionFilter\n VirtualProtect\n GetDriveTypeW\n recvfrom\n closesocket\n sendto\n connect\n send\n socket\n WSAStartup\n recv\n GetSystemDirectoryW\n LoadLibraryExA\n GetFileAttributesW\n GetSystemInfo","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\SaPub.exe\"\" - (UID: 00000000-00008688)\n \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\h (1).exe\"\" - (UID: 00000000-00008688)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"details too long to display","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/26 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"13/24 Antivirus vendors marked dropped file \"SaPub.exe\" as malicious (classified as \"Win64.Kryptik\" with 54% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"13/24 Antivirus vendors marked spawned process \"SaPub.exe\" (PID: 7604) as malicious (classified as \"Win64.Kryptik\" with 54% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 7 sections\" was dropped at \"%ALLUSERSPROFILE%\\x64dbg\\msvcp140.dll\"\n File type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections\" was dropped at \"%ALLUSERSPROFILE%\\x64dbg\\x64dbg.exe\"\n File type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections\" was dropped at \"%ALLUSERSPROFILE%\\GameSDKs\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\SaPub.exe\" (Handle: 1612)\n \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\SaPub.exe\" (Handle: 1612)\n \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\h (1).exe\" (Handle: 1264)\n \"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\h (1).exe\" (Handle: 1264)\n \"h ?1?.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\vzwf1d981e3j\\Akfshnr_x86.exe\" (Handle: 516)\n \"h ?1?.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\vzwf1d981e3j\\Akfshnr_x86.exe\" (Handle: 516)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_DLInjector04\" matched file \"sample.bin\" as \"Detects downloader / injector\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"malicious","category":"System Security","name":"Starts service using SC.exe","description":"Process \"sc.exe\" with commandline \"start \"GameSDK\"\" (UID: 00000000-00000284)","origin":"Monitored Target","mitre_attack_id":"T1569.002","relevance":10,"id":"target-303","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"malicious","category":"System Security","name":"Stops or deletes service using sc.exe","description":"Process \"sc.exe\" with commandline \"stop UsoSvc\" (UID: 00000000-00006240)\n Process \"sc.exe\" with commandline \"stop WaaSMedicSvc\" (UID: 00000000-00000568)\n Process \"sc.exe\" with commandline \"stop wuauserv\" (UID: 00000000-00004936)\n Process \"sc.exe\" with commandline \"stop bits\" (UID: 00000000-00004508)\n Process \"sc.exe\" with commandline \"stop dosvc\" (UID: 00000000-00002196)\n Process \"sc.exe\" with commandline \"delete \"GameSDK\"\" (UID: 00000000-00002300)\n Process \"sc.exe\" with commandline \"stop eventlog\" (UID: 00000000-00001636)\n Process \"sc.exe\" with commandline \"stop UsoSvc\" (UID: 00000000-00002164)\n Process \"sc.exe\" with commandline \"stop WaaSMedicSvc\" (UID: 00000000-00007304)\n Process \"sc.exe\" with commandline \"stop wuauserv\" (UID: 00000000-00007624)\n Process \"sc.exe\" with commandline \"stop bits\" (UID: 00000000-00007668)\n Process \"sc.exe\" with commandline \"stop dosvc\" (UID: 00000000-00005960)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":10,"id":"target-150","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$74","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Stops or deletes service using sc.exe"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"References security-related Windows services"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]}],"intel_graph":{"map":{"File:0233e227c746f577bc2f5edc4d720a5a8d9608a4283580b3e8911c8ab49549bd":{"type":"File","value":"0233e227c746f577bc2f5edc4d720a5a8d9608a4283580b3e8911c8ab49549bd"},"File:59198ef475150aec6a5058cc3a9fcfcc17485ca07232c5f65d2c403434e05049":{"type":"File","value":"59198ef475150aec6a5058cc3a9fcfcc17485ca07232c5f65d2c403434e05049"},"File:5abbb9bc982a2289e354a1bd4ad97e0748d64af94887aa9dfef091d7d08eddf3":{"type":"File","value":"5abbb9bc982a2289e354a1bd4ad97e0748d64af94887aa9dfef091d7d08eddf3"},"File:642827d74fa92dd52c91672a48c268446327c536c2190d57a331d4b113b96db2":{"type":"File","value":"642827d74fa92dd52c91672a48c268446327c536c2190d57a331d4b113b96db2"},"File:8725f4b226d133e9f6fdebac0fa56ec59a1e02641df38b9557febfc3d3a33c84":{"type":"File","value":"8725f4b226d133e9f6fdebac0fa56ec59a1e02641df38b9557febfc3d3a33c84"},"File:8bcc95c5ce896218ef7e135f17574470ea91c5232614f40df39d29b598dddf65":{"type":"File","value":"8bcc95c5ce896218ef7e135f17574470ea91c5232614f40df39d29b598dddf65"},"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7":{"type":"File","value":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},"File:9dd663cf95cd1bd2081b2083990afbc325630a4da793267c9be90eba59f3a485":{"type":"File","value":"9dd663cf95cd1bd2081b2083990afbc325630a4da793267c9be90eba59f3a485"},"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af":{"type":"File","value":"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","verdict":{"verdict":"suspicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as packed by ClamAV antivirus"]}},"File:d93df3d5f4cbe067c52422b8ce698ff6cf87d588f994f1b01983eea44b645021":{"type":"File","value":"d93df3d5f4cbe067c52422b8ce698ff6cf87d588f994f1b01983eea44b645021"}},"chains":[{"id":"1569628952933455282","root":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as packed by ClamAV antivirus"]}},{"id":"sandbox_files","root":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","edges":[{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:59198ef475150aec6a5058cc3a9fcfcc17485ca07232c5f65d2c403434e05049"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:8725f4b226d133e9f6fdebac0fa56ec59a1e02641df38b9557febfc3d3a33c84"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:5abbb9bc982a2289e354a1bd4ad97e0748d64af94887aa9dfef091d7d08eddf3"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:0233e227c746f577bc2f5edc4d720a5a8d9608a4283580b3e8911c8ab49549bd"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:8bcc95c5ce896218ef7e135f17574470ea91c5232614f40df39d29b598dddf65"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:8725f4b226d133e9f6fdebac0fa56ec59a1e02641df38b9557febfc3d3a33c84"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:642827d74fa92dd52c91672a48c268446327c536c2190d57a331d4b113b96db2"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:9dd663cf95cd1bd2081b2083990afbc325630a4da793267c9be90eba59f3a485"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:d93df3d5f4cbe067c52422b8ce698ff6cf87d588f994f1b01983eea44b645021"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"},{"edge_kind":"extracted","from_key":"File:a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","to_key":"File:96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":25,"spawned_processes_count":25,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":61,"imported_dlls_count":129,"dropped_files_count":0,"extracted_files_count":17,"files_written_count":19,"files_deleted_count":0,"registry_keys_created_count":23,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":23,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["mokes","evasive","windows-server-utility"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6af2d4dd7e0415fcc40b93a2","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL.Obfuscator","submit_name":"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe","analysis_start_time":"2026-11-10T08:25:03+00:00","indicators_count":{"informative":241,"suspicious":62,"malicious":13},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}],"processes":[{"pid":8688,"ppid":0,"name":"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe","command_line":"","sha256":"a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af","normalized_path":"C:\\a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af.exe","uid":"00000000-00008688","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7604,"ppid":8688,"name":"SaPub.exe","command_line":"","sha256":"8725f4b226d133e9f6fdebac0fa56ec59a1e02641df38b9557febfc3d3a33c84","normalized_path":"%TEMP%\\SaPub.exe","parent_uid":"00000000-00008688","uid":"00000000-00007604"},{"pid":7576,"ppid":7604,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force","sha256":"9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00007604","uid":"00000000-00007576"},{"pid":6568,"ppid":7604,"name":"cmd.exe","command_line":"/c wusa /uninstall /kb:890830 /quiet /norestart","sha256":"badf4752413cb0cbdc03fb95820ca167f0cdc63b597ccdb5ef43111180e088b0","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007604","uid":"00000000-00006568"},{"pid":7272,"ppid":6568,"name":"wusa.exe","command_line":"wusa /uninstall /kb:890830 /quiet /norestart","sha256":"8fda50de8e2cf99a379d9a0c49f33d218c610b97613653efaf881f42bdde65b5","normalized_path":"%WINDIR%\\system32\\wusa.exe","parent_uid":"00000000-00006568","uid":"00000000-00007272"},{"pid":6240,"ppid":7604,"name":"sc.exe","command_line":"stop UsoSvc","sha256":"41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00007604","uid":"00000000-00006240"},{"pid":568,"ppid":7604,"name":"sc.exe","command_line":"stop WaaSMedicSvc","sha256":"41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00007604","uid":"00000000-00000568"},{"pid":4936,"ppid":7604,"name":"sc.exe","command_line":"stop wuauserv","sha256":"41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00007604","uid":"00000000-00004936"},{"pid":4508,"ppid":7604,"name":"sc.exe","command_line":"stop bits","sha256":"41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00007604","uid":"00000000-00004508"},{"pid":2196,"ppid":7604,"name":"sc.exe","command_line":"stop dosvc","sha256":"41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00007604","uid":"00000000-00002196"},{"pid":3680,"ppid":7604,"name":"powercfg.exe","command_line":"/x -hibernate-timeout-ac 0","sha256":"cb2459971a56cee45a30346281ff3b0eccea0c2bee1ae6b8477712404d2e6ae1","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00007604","uid":"00000000-00003680"},{"pid":5064,"ppid":7604,"name":"powercfg.exe","command_line":"/x -standby-timeout-ac 0","sha256":"cb2459971a56cee45a30346281ff3b0eccea0c2bee1ae6b8477712404d2e6ae1","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00007604","uid":"00000000-00005064"},{"pid":9188,"ppid":7604,"name":"powercfg.exe","command_line":"/x -hibernate-timeout-dc 0","sha256":"cb2459971a56cee45a30346281ff3b0eccea0c2bee1ae6b8477712404d2e6ae1","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00007604","uid":"00000000-00009188"},{"pid":7900,"ppid":7604,"name":"powercfg.exe","command_line":"/x -standby-timeout-dc 0","sha256":"cb2459971a56cee45a30346281ff3b0eccea0c2bee1ae6b8477712404d2e6ae1","normalized_path":"%WINDIR%\\system32\\powercfg.exe","parent_uid":"00000000-00007604","uid":"00000000-00007900"},{"pid":2300,"ppid":7604,"name":"sc.exe","command_line":"delete \"GameSDK\"","sha256":"41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00007604","uid":"00000000-00002300"},{"pid":924,"ppid":7604,"name":"sc.exe","command_line":"create \"GameSDK\" binpath= \"%ALLUSERSPROFILE%\\GameSDKs\" start= \"auto\"","sha256":"41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00007604","uid":"00000000-00000924"},{"pid":1636,"ppid":7604,"name":"sc.exe","command_line":"stop eventlog","sha256":"41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00007604","uid":"00000000-00001636"},{"pid":284,"ppid":7604,"name":"sc.exe","command_line":"start \"GameSDK\"","sha256":"41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9","normalized_path":"%WINDIR%\\system32\\sc.exe","parent_uid":"00000000-00007604","uid":"00000000-00000284"},{"pid":1168,"ppid":8688,"name":"h ?1?.exe","command_line":"","sha256":"0233e227c746f577bc2f5edc4d720a5a8d9608a4283580b3e8911c8ab49549bd","normalized_path":"%TEMP%\\h (1).exe","parent_uid":"00000000-00008688","uid":"00000000-00001168"},{"pid":8224,"ppid":1168,"name":"Akfshnr_x86.exe","command_line":"","sha256":"f1d117ee7395fe05433281b05c19aeb1123e4af3d0bbe3a13d629102595c3b8c","normalized_path":"%TEMP%\\vzwf1d981e3j\\Akfshnr_x86.exe","parent_uid":"00000000-00001168","uid":"00000000-00008224"},{"pid":2164,"ppid":0,"name":"sc.exe","command_line":"stop UsoSvc","sha256":"41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9","normalized_path":"%WINDIR%\\system32\\sc.exe","uid":"00000000-00002164","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7304,"ppid":0,"name":"sc.exe","command_line":"stop WaaSMedicSvc","sha256":"41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9","normalized_path":"%WINDIR%\\system32\\sc.exe","uid":"00000000-00007304","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7624,"ppid":0,"name":"sc.exe","command_line":"stop wuauserv","sha256":"41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9","normalized_path":"%WINDIR%\\system32\\sc.exe","uid":"00000000-00007624","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7668,"ppid":0,"name":"sc.exe","command_line":"stop bits","sha256":"41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9","normalized_path":"%WINDIR%\\system32\\sc.exe","uid":"00000000-00007668","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":5960,"ppid":0,"name":"sc.exe","command_line":"stop dosvc","sha256":"41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba9","normalized_path":"%WINDIR%\\system32\\sc.exe","uid":"00000000-00005960","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["AppxSip.dll","powrprof.dll","gdi32.dll","version.dll","mscorlib.ni.dll","clbcatq.dll","pwrshsip.dll","System.Data.ni.dll","wtsapi32.dll","umpdc.dll","ntdll.dll","wow64win.dll","kernel32.dll","VxSSL32.dll","ws2_32.dll","win32u.dll","OneCoreCommonProxyStub.dll","msisip.dll","System.Transactions.ni.dll","cfgmgr32.dll","Microsoft.Management.Infrastructure.ni.dll","dpapi.dll","fastprox.dll","cryptsp.dll","kernel.appcore.dll","System.ni.dll","srvcli.dll","BCP47Langs.dll","wintrust.dll","dpx.dll","comctl32.dll","wow64.dll","sechost.dll","sspicli.dll","ole32.dll","wldp.dll","vcruntime140_1.dll","crypt32.dll","secur32.dll","miutils.dll","fltLib.dll","atl.dll","Microsoft.WSMan.Management.ni.dll","clr.dll","vcruntime140_clr0400.dll","virtdisk.dll","System.Configuration.ni.dll","wininet.dll","windows.storage.dll","System.Management.ni.dll","Microsoft.AppV.AppVClientPowerShell.dll","Microsoft.PowerShell.Commands.Management.ni.dll","imm32.dll","System.Management.Automation.ni.dll","wbemprox.dll","shlwapi.dll","rsaenh.dll","9sLNHV12.dll","System.Data.dll","KdsCli.dll","clrjit.dll","propsys.dll","bcryptprimitives.dll","Microsoft.Management.Infrastructure.Native.ni.dll","Microsoft.AppV.AppvClientComConsumer.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","Microsoft.KeyDistributionService.Cmdlets.ni.dll","ntasn1.dll","oleaut32.dll","urlmon.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","edputil.dll","System.DirectoryServices.ni.dll","normaliz.dll","sxs.dll","wow64cpu.dll","mi.dll","Microsoft.IIS.Powershell.Commands.ni.dll","ucrtbase.dll","msvcp140.dll","Windows.StateRepositoryPS.dll","slc.dll","rpcrt4.dll","ucrtbase_clr0400.dll","userenv.dll","Microsoft.PowerShell.Security.ni.dll","vcruntime140.dll","OneCoreUAPCommonProxyStub.dll","OpcServices.dll","shell32.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","amsi.dll","wmidcom.dll","user32.dll","msctf.dll","profapi.dll","gpapi.dll","wbemcomn.dll","Microsoft.KeyDistributionService.Cmdlets.dll","apphelp.dll","System.Core.ni.dll","uxtheme.dll","psapi.dll","AppResolver.dll","VxSSL64.dll","wbemsvc.dll","Wldap32.dll","netutils.dll","WinTypes.dll","wshext.dll","mscoree.dll","KernelBase.dll","gdi32full.dll","combase.dll","iertutil.dll","sppc.dll","coml2.dll","advapi32.dll","cryptbase.dll","System.Transactions.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","msvcp_win.dll","msvcrt.dll","mscoreei.dll","System.Configuration.Install.ni.dll","bcrypt.dll","SHCore.dll","msasn1.dll","System.Xml.ni.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"msvcp140.dll","sha256":"59198ef475150aec6a5058cc3a9fcfcc17485ca07232c5f65d2c403434e05049","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SaPub.exe","sha256":"8725f4b226d133e9f6fdebac0fa56ec59a1e02641df38b9557febfc3d3a33c84","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"Akfshnr_x86.exe","sha256":"5abbb9bc982a2289e354a1bd4ad97e0748d64af94887aa9dfef091d7d08eddf3","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"h _1_.exe","sha256":"0233e227c746f577bc2f5edc4d720a5a8d9608a4283580b3e8911c8ab49549bd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"x64dbg.exe","sha256":"8bcc95c5ce896218ef7e135f17574470ea91c5232614f40df39d29b598dddf65","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"__PSScriptPolicyTest_3jrwjjkn.ctu.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"__PSScriptPolicyTest_frnvj022.k2u.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"__PSScriptPolicyTest_tj2yj0ud.wod.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"__PSScriptPolicyTest_t3tcznfx.xpj.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"GameSDKs","sha256":"8725f4b226d133e9f6fdebac0fa56ec59a1e02641df38b9557febfc3d3a33c84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"config","sha256":"642827d74fa92dd52c91672a48c268446327c536c2190d57a331d4b113b96db2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"ModuleAnalysisCache","sha256":"9dd663cf95cd1bd2081b2083990afbc325630a4da793267c9be90eba59f3a485","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"StartupProfileData-NonInteractive","sha256":"d93df3d5f4cbe067c52422b8ce698ff6cf87d588f994f1b01983eea44b645021","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"__PSScriptPolicyTest_jlpbtglm.pnn.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"__PSScriptPolicyTest_nt3xnlnb.jiz.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"__PSScriptPolicyTest_qyjb2coe.puu.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"__PSScriptPolicyTest_tpf4dpn5.cnf.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%TEMP%\\SaPub.exe","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%TEMP%\\h (1).exe","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%ALLUSERSPROFILE%\\GameSDKs","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_3jrwjjkn.ctu.ps1","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_nt3xnlnb.jiz.psm1","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_tj2yj0ud.wod.ps1","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_qyjb2coe.puu.psm1","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%TEMP%\\vzwf1d981e3j\\Akfshnr_x86.exe","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%ALLUSERSPROFILE%\\x64dbg\\msvcp140.dll","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%ALLUSERSPROFILE%\\x64dbg\\x64dbg.exe","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%ALLUSERSPROFILE%\\config","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_frnvj022.k2u.ps1","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_jlpbtglm.pnn.psm1","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\MRT\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8688:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8688:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8688:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"Local\\SM0:8688:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"Local\\SM0:8688:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:8688:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:8688:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8688:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7604:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\BaseNamedObjects\\nedawykbudvincowahyoeovy","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:7604:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7576:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:7576:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"Local\\SM0:7576:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:7576:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"Local\\SM0:7576:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7576:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7576:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7576:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:6568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7272:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:7272:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:6240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:4936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:4508:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:2196:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:3680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:5064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:9188:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:2300:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:924:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:924:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:1636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:284:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:284:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1168:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:1168:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8224:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8224:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"Local\\SM0:8224:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:8224:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"Local\\SM0:8224:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"SM0:8224:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8224:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8224:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af2d4dd7e0415fcc40b93a2"}]}]}},"report_ids":{"sandbox_job_ids":["6af2d4dd7e0415fcc40b93a2"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious IL:Trojan.Downloader Sample a92f2d3dc8ca… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a92f2d3dc8ca…. Malware family: IL:Trojan.Downloader. Threat score 100/100. 15/28 AV engines flagged this file. 15 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af"}],["$","meta","4",{"property":"og:title","content":"Malicious IL:Trojan.Downloader Sample a92f2d3dc8ca… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a92f2d3dc8ca…. Malware family: IL:Trojan.Downloader. Threat score 100/100. 15/28 AV engines flagged this file. 15 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a92f2d3dc8ca44a3aa1be1fdf21bfa19728e2394a9dc8f134d92facdfd1107af"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious IL:Trojan.Downloader Sample a92f2d3dc8ca… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a92f2d3dc8ca…. Malware family: IL:Trojan.Downloader. Threat score 100/100. 15/28 AV engines flagged this file. 15 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L75","11",{}]] 32:null