26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 50:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample ad3b7fbafb3b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ad3b7fbafb3b…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/28 AV engines flagged this file. 13 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715"],"about":{"@type":"SoftwareApplication","name":"DHL.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":5,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tc02,Assembly shows XOR instruction xor byte ptr [ecx] al in Stream UID: 00000000-00004008-58092-1-010C7B2A Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00004008-58092-1-010C7B2A Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00004008-58092-1-010C7B2A Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00004008-58092-1-010C7B2A Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00004008-58092-1-010C7B2A Assembly shows XOR instruction xor byte ptr [edx] al in Stream UID: 00000000-00004008-58092-1-010C7B2A Assembly shows XOR instruction xor eax 6F0A0000h in Stream UID: 00000000-00004008-58092-1-010C7B2A Assembly shows XOR instruction xor byte ptr [ebx] al in Stream UID: 00000000-00004008-58092-1-010C7B2A Assembly shows XOR instruction xor byte ptr [ecx] al in Stream UID: 00000000-00002492-740-1-001C7B2A Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00002492-740-1-001C7B2A Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00002492-740-1-001C7B2A Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00002492-740-1-001C7B2A Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00002492-740-1-001C7B2A Assembly shows XOR instruction xor byte ptr [edx] al in Stream UID: 00000000-00002492-740-1-001C7B2A Assembly shows XOR instruction xor eax 6F0A0000h in Stream UID: 00000000-00002492-740-1-001C7B2A Assembly shows XOR instruction xor byte ptr [ebx] al in Stream UID: 00000000-00002492-740-1-001C7B2A Assembly shows XOR instruction xor ecx FFFFFFF7h in Stream UID: 1703-389-0046E8F0 Assembly shows XOR instruction xor byte ptr [eax+128E0395h] cl in Stream UID: 1703-389-0046E8F0 Assembly shows XOR instruction xor dword ptr [edi+7Eh] D3C6FB34h in Stream UID: 1703-389-0046E8F0 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 1703-389-0046E8F0 Assembly shows XOR instruction xor eax 7F0D07ECh in Stream UID: 1703-389-0046E8F0 Assembly shows XOR instruction xor al byte ptr [edi] in Stream UID: 1703-169-0040E2CA Assembly shows XOR instruction xor byte ptr [eax+edi] al in Stream UID: 1703-169-0040E2CA Assembly shows XOR instruction xor dl byte ptr [ebx] in Stream UID: 1703-169-0040E2CA Assembly shows XOR instruction xor byte ptr [edx] al in Stream UID: 1703-1-004F7B2A Assembly shows XOR instruction xor byte ptr [ecx] al in Stream UID: 1703-1-004F7B2A Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 1703-1-004F7B2A Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 1703-1-004F7B2A Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 1703-1-004F7B2A Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 1703-1-004F7B2A Assembly shows XOR instruction xor eax 6F0A0000h in Stream UID: 1703-1-004F7B2A Assembly shows XOR instruction xor byte ptr [ebx] al in Stream UID: 1703-1-004F7B2A28:T42c,Found reference to API "Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt" (Indicator: "CryptProtectData"; Source: "00000000-00002492.00000000.77475.01B60000.00000004.mdmp") Found reference to API "description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt"" (Indicator: "CryptProtectData"; Source: "00000000-00002492.00000000.77475.01B60000.00000004.mdmp") Found reference to API "description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decry8" (Indicator: "CryptProtectData"; Source: "00000000-00004008.00000000.67692.00260000.00000004.mdmp"), Found reference to API "description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt"" (Indicator: "CryptProtectData"; Source: "00000000-00004008.00000000.67692.00260000.00000004.mdmp"), Found reference to API "Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt" (Indicator: "CryptProtectData"; Source: "00000000-00004008.00000000.67692.01CD0000.00000004.mdmp")29:T540,".exe" called "RtlGetVersion" (UID: 00000000-00004008) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004008) ".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004008)2a:T4e1,".exe" queries volume information of "C:\ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe" at 00000000-00004008-0000010C-2012417 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004008-0000010C-10433678761364407 "RegSvcs.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" at 00000000-00001740-0000010C-1878983 "RegSvcs.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00001740-0000010C-7332939 "RegSvcs.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00001740-0000010C-7341250 "DmLfWZhKpoh.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\DmLfWZhKpoh.exe" at 00000000-00002492-0000010C-1290271 "DmLfWZhKpoh.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002492-0000010C-33965012b:T5d97,".exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runt73a1fc9d#\fd0048cfdcd58dd454d2575e5cb55e70\System.Runtime.Remoting.ni.dl (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00004008) ".exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00004008) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\schtasks.exe (UID: 00000000-00000384) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000384) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00000384) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\vaultcli.dll (UID: 00000000-00001740) "RegSvcs.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00001740) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runt73a1fc9d#\fd0048cfdcd58dd454d2575e5cb55e70\System.Runtime.Remoting.ni.dl (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002492)2c:T765,"insert into Product (item , Quantity) values (@item, @Quantity)" (Source: ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin, Indicator: "insert into product (item , quantity) values (@item, @quantity)"), "insert into registration(FirstName, LastName, UserName, Password1 )values(@first, @last, @username, @password)" (Source: ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin, Indicator: "insert into registration(firstname, lastname, username, password1 )values(@first, @last, @username, @password)"), "select * from MakePurchase" (Source: ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin, Indicator: "select * from makepurchase"), "select * from MakePurchase where productId = '" (Source: ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin, Indicator: "select * from makepurchase where productid = '"), "select UserName Password1 from registration where UserName= '" (Source: 6000017-frmLogin~Button1_Click, Indicator: "select username, password1 from registration where username= '"), "insert into employees(FirstName, LastName, Gender, Contact, City, Address1, Email)values(@firstname, @lastname, @gender, @contact, @city, @address, @email)" (Source: 60000a7-frmEmployees~btnSave_Click, Indicator: "insert into employees(firstname, lastname, gender, contact, city, address1, email)values(@firstname, @lastname, @gender, @contact, @city, @address, @email)"), "select * from employees" (Source: 60000af-frmList~frmList_Load, Indicator: "select * from employees"), "select * from Product" (Source: 60000e0-FrmMakePurchase~FrmMakePurchase_Load, Indicator: "select * from product"), "insert into MakePurchase(item, unitPrice, Quantity, Date1, ProductID, EmpNo)values('" (Source: 60000e1-FrmMakePurchase~btnSave_Click, Indicator: "insert into makepurchase(item, unitprice, quantity, date1, productid, empno)values('")2d:T112d,Found reference to API (Indicator: "CompareString"; File: "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin") Found reference to API (Indicator: "GetObject"; File: "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin") Found reference to API (Indicator: "MessageBox"; File: "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin") Found reference to API (Indicator: "CompareString"; Source: "00000000-00002492.00000000.77475.000D2000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00002492.00000000.77475.000D2000.00000020.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00002492.00000000.77475.000D2000.00000020.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00002492.00000000.77475.01B60000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002492.00000000.77475.01B60000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00002492.00000000.77475.01B60000.00000004.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00004008.00000000.67692.00FD2000.00000020.mdmp, 00000000-00004008.00000001.69408.00FD2000.00000020.mdmp, 00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00004008.00000000.67692.00FD2000.00000020.mdmp, 00000000-00004008.00000001.69408.005C0000.00000004.mdmp, 00000000-00004008.00000001.69408.00FD2000.00000020.mdmp, 00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00004008.00000000.67692.00FD2000.00000020.mdmp, 00000000-00004008.00000001.69408.005C0000.00000004.mdmp, 00000000-00004008.00000001.69408.00FD2000.00000020.mdmp, 00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004008.00000001.69408.005C0000.00000004.mdmp, 00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributes"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "GetUserName"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "Wow64GetThreadContext"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "Wow64SetThreadContext"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp") Found reference to API (Indicator: "NtContinue"; Source: "00000000-00004008.00000001.69408.05B20000.00000004.mdmp")2e:Tdd9,"System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SOFTWARE\Microsoft\Windo" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.NET Data Provider for SqlServer\Performance" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET Data Provider for SqlServer\Performance" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.net data provider for sqlserver\Performance" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net data provider for sqlserver\Performance" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "Software\Microsoft\MSSQLServer\Client\SuperSocketNetLib" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "HKEY_LOCAL_MACHINE\" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\MSSQLServer\Client\SuperSocketNetLib" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002492.00000000.77475.7F6F0000.00000002.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004008.00000000.67692.01CD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004008.00000000.67692.01CD0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00004008.00000000.67692.7F6F0000.00000002.mdmp 00000000-00004008.00000001.69408.7F6F0000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004008.00000001.69408.00260000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004008.00000001.69408.00260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004008.00000001.69408.00260000.00000004.mdmp "Software\Microso\" in Source: 00000000-00004008.00000001.69408.0599A000.00000004.mdmp2f:T15bb,".exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vaultcli.dll" - [base:0; Status:c0000135] "DmLfWZhKpoh.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "DmLfWZhKpoh.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "DmLfWZhKpoh.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "DmLfWZhKpoh.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "DmLfWZhKpoh.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "DmLfWZhKpoh.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "DmLfWZhKpoh.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "DmLfWZhKpoh.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "DmLfWZhKpoh.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "DmLfWZhKpoh.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "DmLfWZhKpoh.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "DmLfWZhKpoh.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "DmLfWZhKpoh.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]30:Te28,"System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SOFTWARE\Microsoft\Windo" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.NET Data Provider for SqlServer\Performance" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET Data Provider for SqlServer\Performance" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\.net data provider for sqlserver\Performance" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net data provider for sqlserver\Performance" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Romance Standard Time\Dynamic DST" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "Software\Microsoft\MSSQLServer\Client\SuperSocketNetLib" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "HKEY_LOCAL_MACHINE\" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\MSSQLServer\Client\SuperSocketNetLib" in Source: 00000000-00002492.00000000.77475.01B60000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002492.00000000.77475.7F6F0000.00000002.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004008.00000000.67692.01CD0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004008.00000000.67692.01CD0000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00004008.00000000.67692.7F6F0000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004008.00000001.69408.00260000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004008.00000001.69408.00260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004008.00000001.69408.00260000.00000004.mdmp "Software\Microso\" in Source: 00000000-00004008.00000001.69408.0599A000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00004008.00000001.69408.7F6F0000.00000002.mdmp31:T65fe,".exe" loaded module "%WINDIR%\System32\ntdll.dll" at 77830000 ".exe" loaded module "C:\ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe" at 00FD0000 ".exe" loaded module "%WINDIR%\System32\mscoree.dll" at 6CBD0000 ".exe" loaded module "%WINDIR%\System32\kernel32.dll" at 77510000 ".exe" loaded module "%WINDIR%\System32\KernelBase.dll" at 75820000 ".exe" loaded module "%WINDIR%\System32\advapi32.dll" at 776D0000 ".exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 6CB80000 ".exe" loaded module "%WINDIR%\System32\ws2_32.dll" at 779C0000 ".exe" loaded module "%WINDIR%\System32\nsi.dll" at 75A70000 ".exe" loaded module "%WINDIR%\System32\fltLib.dll" at 6D1D0000 ".exe" loaded module "%WINDIR%\System32\api-ms-win-core-synch-l1-2-0.dll" at 729E0000 ".exe" loaded module "%WINDIR%\System32\msctf.dll" at 75D30000 ".exe" loaded module "%WINDIR%\System32\shlwapi.dll" at 76DC0000 ".exe" loaded module "%WINDIR%\System32\version.dll" at 74CB0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" at 68400000 ".exe" loaded module "%WINDIR%\System32\ucrtbase_clr0400.dll" at 696C0000 ".exe" loaded module "%WINDIR%\Globalization\Sorting\SortDefault.nls" at 03CD0000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" at 66D40000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" at 66520000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" at 66330000 ".exe" loaded module "%WINDIR%\System32\api-ms-win-core-xstate-l2-1-0.dll" at 6CB70000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" at 6C5F0000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" at 64B90000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" at 6C530000 ".exe" loaded module "%WINDIR%\System32\cryptsp.dll" at 75140000 ".exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 00440000 ".exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 74ED0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 64510000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll" at 642A0000 ".exe" loaded module "%WINDIR%\System32\crypt32.dll" at 75880000 ".exe" loaded module "%WINDIR%\System32\msasn1.dll" at 75750000 ".exe" loaded module "%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 045D0000 ".exe" loaded module "%WINDIR%\System32\en-US\tzres.dll.mui" at 00470000 ".exe" loaded module "%LOCALAPPDATA%\GDIPFONTCACHEV1.DAT" at 005B0000 ".exe" loaded module "%WINDIR%\Fonts\malgun.ttf" at 048D0000 ".exe" loaded module "%WINDIR%\Fonts\segoeui.ttf" at 00AD0000 ".exe" loaded module "%WINDIR%\Fonts\timesbd.ttf" at 04CD0000 ".exe" loaded module "%WINDIR%\Fonts\StaticCache.dat" at 04EA0000 ".exe" loaded module "%WINDIR%\Fonts\MTCORSVA.TTF" at 006B0000 ".exe" loaded module "%WINDIR%\System32\propsys.dll" at 74470000 ".exe" loaded module "%WINDIR%\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" at 745B0000 ".exe" loaded module "%WINDIR%\System32\apphelp.dll" at 755E0000 ".exe" loaded module "%WINDIR%\System32\clbcatq.dll" at 775F0000 ".exe" loaded module "%WINDIR%\System32\ieframe.dll" at 6D240000 ".exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll" at 75790000 ".exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll" at 759D0000 ".exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-user32-l1-1-0.dll" at 75810000 ".exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-shell32-l1-1-0.dll" at 72830000 ".exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-version-l1-1-0.dll" at 75760000 ".exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll" at 75870000 ".exe" loaded module "%WINDIR%\System32\normaliz.dll" at 75EA0000 ".exe" loaded module "%WINDIR%\System32\iertutil.dll" at 76E20000 ".exe" loaded module "%WINDIR%\System32\ntmarta.dll" at 74C50000 ".exe" loaded module "%WINDIR%\System32\Wldap32.dll" at 75ED0000 ".exe" loaded module "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\cversions.2.db" at 00E00000 ".exe" loaded module "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000016.db" at 00F50000 ".exe" loaded module "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\cversions.2.db" at 00FC0000 ".exe" loaded module "%ALLUSERSPROFILE%\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" at 0B4E0000 ".exe" loaded module "%WINDIR%\System32\urlmon.dll" at 77060000 ".exe" loaded module "%WINDIR%\System32\secur32.dll" at 75470000 ".exe" loaded module "%WINDIR%\AppPatch\sysmain.sdb" at 0B7A0000 ".exe" loaded module "%WINDIR%\System32\msvcrt.dll" at 77780000 ".exe" loaded module "%WINDIR%\System32\sechost.dll" at 77990000 ".exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75FF0000 ".exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 6C870000 ".exe" loaded module "%WINDIR%\System32\user32.dll" at 760A0000 ".exe" loaded module "%WINDIR%\System32\gdi32.dll" at 77680000 ".exe" loaded module "%WINDIR%\System32\lpk.dll" at 779B0000 ".exe" loaded module "%WINDIR%\System32\usp10.dll" at 75F20000 ".exe" loaded module "%WINDIR%\System32\ole32.dll" at 77350000 ".exe" loaded module "%WINDIR%\System32\oleaut32.dll" at 75E00000 ".exe" loaded module "%WINDIR%\System32\imm32.dll" at 00210000 ".exe" loaded module "%WINDIR%\System32\imm32.dll" at 75EB0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" at 6C7E0000 ".exe" loaded module "C:\ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe" at 00360000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" at 68BB0000 ".exe" loaded module "%WINDIR%\System32\vcruntime140_clr0400.dll" at 6CB00000 ".exe" loaded module "%WINDIR%\System32\psapi.dll" at 77980000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 677A0000 ".exe" loaded module "%WINDIR%\System32\rpcss.dll" at 00580000 ".exe" loaded module "%WINDIR%\System32\cryptbase.dll" at 75630000 ".exe" loaded module "%WINDIR%\System32\uxtheme.dll" at 741B0000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" at 66180000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" at 65310000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" at 695B0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp" at 04120000 ".exe" loaded module "%WINDIR%\System32\shell32.dll" at 76170000 ".exe" loaded module "%WINDIR%\System32\profapi.dll" at 75740000 ".exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 75250000 ".exe" loaded module "%WINDIR%\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll" at 6CC20000 ".exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runt73a1fc9d#\fd0048cfdcd58dd454d2575e5cb55e70\System.Runtime.Remoting.ni.dll" at 64AC0000 ".exe" loaded module "%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 63F40000 ".exe" loaded module "%WINDIR%\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\GdiPlus.dll" at 73FD0000 ".exe" loaded module "%WINDIR%\System32\RpcRtRemote.dll" at 756D0000 ".exe" loaded module "%WINDIR%\Fonts\timesi.ttf" at 04B10000 ".exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" at 00D80000 ".exe" loaded module "%WINDIR%\System32\WindowsCodecs.dll" at 73DA0000 ".exe" loaded module "%WINDIR%\WindowsShell.Manifest" at 007B0000 ".exe" loaded module "%WINDIR%\System32\setupapi.dll" at 771B0000 ".exe" loaded module "%WINDIR%\System32\cfgmgr32.dll" at 757D0000 ".exe" loaded module "%WINDIR%\System32\devobj.dll" at 759B0000 ".exe" loaded module "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000030.db" at 00F30000 ".exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-ole32-l1-1-0.dll" at 75800000 ".exe" loaded module "%WINDIR%\System32\wininet.dll" at 75A80000 ".exe" loaded module "%WINDIR%\System32\userenv.dll" at 75770000 ".exe" loaded module "%WINDIR%\System32\sspicli.dll" at 755C0000 "schtasks.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 77510000 "schtasks.exe" loaded module "%WINDIR%\System32\KernelBase.dll" at 75820000 "schtasks.exe" loaded module "%WINDIR%\System32\msvcrt.dll" at 77780000 "schtasks.exe" loaded module "%WINDIR%\System32\user32.dll" at 760A0000 "schtasks.exe" loaded module "%WINDIR%\System32\gdi32.dll" at 77680000 "schtasks.exe" loaded module "%WINDIR%\System32\lpk.dll" at 779B0000 "schtasks.exe" loaded module "%WINDIR%\System32\usp10.dll" at 75F20000 "schtasks.exe" loaded module "%WINDIR%\System32\ole32.dll" at 77350000 "schtasks.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75FF0000 "schtasks.exe" loaded module "%WINDIR%\System32\oleaut32.dll" at 75E00000 "schtasks.exe" loaded module "%WINDIR%\System32\shlwapi.dll" at 76DC0000 "schtasks.exe" loaded module "%WINDIR%\System32\ktmw32.dll" at 734C0000 "schtasks.exe" loaded module "%WINDIR%\System32\imm32.dll" at 00200000 "schtasks.exe" loaded module "%WINDIR%\System32\imm32.dll" at 75EB0000 "schtasks.exe" loaded module "%WINDIR%\System32\msctf.dll" at 75D30000 "schtasks.exe" loaded module "%WINDIR%\System32\en-US\schtasks.exe.mui" at 00230000 "schtasks.exe" loaded module "%WINDIR%\System32\version.dll" at 74CB0000 "schtasks.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 6C870000 "schtasks.exe" loaded module "%WINDIR%\System32\advapi32.dll" at 776D0000 "schtasks.exe" loaded module "%WINDIR%\System32\sechost.dll" at 77990000 "schtasks.exe" loaded module "%WINDIR%\System32\fltLib.dll" at 6D1D0000 "schtasks.exe" loaded module "%WINDIR%\System32\api-ms-win-core-synch-l1-2-0.dll" at 729E0000 "schtasks.exe" loaded module "%WINDIR%\Globalization\Sorting\SortDefault.nls" at 01730000 "schtasks.exe" loaded module "%WINDIR%\System32\rpcss.dll" at 00550000 "schtasks.exe" loaded module "%WINDIR%\System32\cryptbase.dll" at 75630000 "schtasks.exe" loaded module "%WINDIR%\System32\uxtheme.dll" at 741B0000 "schtasks.exe" loaded module "%WINDIR%\System32\clbcatq.dll" at 775F0000 "schtasks.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 73820000 "schtasks.exe" loaded module "%WINDIR%\System32\sspicli.dll" at 755C0000 "schtasks.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 6CB80000 "schtasks.exe" loaded module "%WINDIR%\System32\ws2_32.dll" at 779C0000 "schtasks.exe" loaded module "%WINDIR%\System32\nsi.dll" at 75A70000 "RegSvcs.exe" loaded module "%WINDIR%\System32\mscoree.dll" at 6CBD0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 77510000 "RegSvcs.exe" loaded module "%WINDIR%\System32\KernelBase.dll" at 75820000 "RegSvcs.exe" loaded module "%WINDIR%\System32\advapi32.dll" at 776D0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\msvcrt.dll" at 77780000 "RegSvcs.exe" loaded module "%WINDIR%\System32\sechost.dll" at 77990000 "RegSvcs.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75FF0000 "RegSvcs.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 6C870000 "RegSvcs.exe" loaded module "%WINDIR%\System32\user32.dll" at 760A0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\gdi32.dll" at 77680000 "RegSvcs.exe" loaded module "%WINDIR%\System32\lpk.dll" at 779B0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\usp10.dll" at 75F20000 "RegSvcs.exe" loaded module "%WINDIR%\System32\ole32.dll" at 77350000 "RegSvcs.exe" loaded module "%WINDIR%\System32\oleaut32.dll" at 75E00000 "RegSvcs.exe" loaded module "%WINDIR%\System32\fltLib.dll" at 6D1D0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\imm32.dll" at 00100000 "RegSvcs.exe" loaded module "%WINDIR%\System32\imm32.dll" at 75EB0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\msctf.dll" at 75D30000 "RegSvcs.exe" loaded module "%WINDIR%\System32\api-ms-win-core-synch-l1-2-0.dll" at 729E0000 "RegSvcs.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" at 6C7E0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\shlwapi.dll" at 76DC0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\version.dll" at 74CB0000 "RegSvcs.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" at 68BB0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\vcruntime140_clr0400.dll" at 6CB00000 "RegSvcs.exe" loaded module "%WINDIR%\System32\ucrtbase_clr0400.dll" at 696C0000 "RegSvcs.exe" loaded module "%WINDIR%\Globalization\Sorting\SortDefault.nls" at 03DC0000 "RegSvcs.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 66390000 "RegSvcs.exe" loaded module "%WINDIR%\System32\rpcss.dll" at 00650000 "RegSvcs.exe" loaded module "%WINDIR%\System32\cryptbase.dll" at 75630000 "RegSvcs.exe" loaded module "%WINDIR%\System32\uxtheme.dll" at 741B0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\api-ms-win-core-xstate-l2-1-0.dll" at 74360000 "RegSvcs.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" at 6CC20000 "RegSvcs.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" at 68150000 "RegSvcs.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" at 67FA0000 "RegSvcs.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" at 65520000 "RegSvcs.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" at 72800000 "RegSvcs.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp" at 04090000 "RegSvcs.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" at 64D00000 "RegSvcs.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" at 67E90000 "RegSvcs.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" at 64580000 "RegSvcs.exe" loaded module "%WINDIR%\System32\shell32.dll" at 76170000 "RegSvcs.exe" loaded module "%WINDIR%\System32\profapi.dll" at 75740000 "RegSvcs.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 75250000 "RegSvcs.exe" loaded module "%WINDIR%\System32\cryptsp.dll" at 75140000 "RegSvcs.exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 00670000 "RegSvcs.exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 74ED0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\psapi.dll" at 77980000 "RegSvcs.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll" at 69590000 "RegSvcs.exe" loaded module "%WINDIR%\System32\RpcRtRemote.dll" at 756D0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\wbem\wbemsvc.dll" at 6F020000 "RegSvcs.exe" loaded module "%WINDIR%\System32\sspicli.dll" at 755C0000 "RegSvcs.exe" loaded module "%WINDIR%\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll" at 00690000 "RegSvcs.exe" loaded module "%WINDIR%\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll" at 6C5F0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\vaultcli.dll" at 6CB60000 "RegSvcs.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Security\93d03eb9812405fa70e89d4efd5f7e14\System.Security.ni.dll" at 67DB0000 "RegSvcs.exe" loaded module "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 67BE0000 "RegSvcs.exe" loaded module "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 67A10000 "RegSvcs.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 6CB80000 "RegSvcs.exe" loaded module "%WINDIR%\System32\ws2_32.dll" at 779C0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\nsi.dll" at 75A70000 "RegSvcs.exe" loaded module "%WINDIR%\System32\clbcatq.dll" at 775F0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\wbem\wmiutils.dll" at 6F000000 "RegSvcs.exe" loaded module "%WINDIR%\System32\wbemcomn.dll" at 6F670000 "RegSvcs.exe" loaded module "%WINDIR%\System32\wbem\wbemprox.dll" at 6F3A0000 "RegSvcs.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WMINet_Utils.dll" at 727D0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\wbem\fastprox.dll" at 6F4D0000 "RegSvcs.exe" loaded module "%WINDIR%\System32\ntdsapi.dll" at 6F430000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 77830000 "DmLfWZhKpoh.exe" loaded module "%APPDATA%\DmLfWZhKpoh.exe" at 000D0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 6CB80000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\ws2_32.dll" at 779C0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\nsi.dll" at 75A70000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\shlwapi.dll" at 76DC0000 "DmLfWZhKpoh.exe" loaded module "%APPDATA%\DmLfWZhKpoh.exe" at 00350000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\version.dll" at 74CB0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" at 68BB0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" at 65120000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\api-ms-win-core-xstate-l2-1-0.dll" at 6E390000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" at 68FC0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" at 62B20000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" at 68EB0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" at 649A0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" at 6CBE0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp" at 042A0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\profapi.dll" at 75740000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 005C0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 74ED0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 67E50000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 680A0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\crypt32.dll" at 75880000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\msasn1.dll" at 75750000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\en-US\tzres.dll.mui" at 005F0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\RpcRtRemote.dll" at 756D0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Fonts\StaticCache.dat" at 05180000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\mscoree.dll" at 727D0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 77510000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\KernelBase.dll" at 75820000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\advapi32.dll" at 776D0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\msvcrt.dll" at 77780000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\sechost.dll" at 77990000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 75FF0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" at 6CC20000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\api-ms-win-core-synch-l1-2-0.dll" at 729E0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 6C870000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\user32.dll" at 760A0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\gdi32.dll" at 77680000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\lpk.dll" at 779B0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\usp10.dll" at 75F20000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\ole32.dll" at 77350000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\oleaut32.dll" at 75E00000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\fltLib.dll" at 6D1D0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\imm32.dll" at 00080000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\imm32.dll" at 75EB0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\msctf.dll" at 75D30000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" at 68400000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\vcruntime140_clr0400.dll" at 6CC00000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\ucrtbase_clr0400.dll" at 69610000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Globalization\Sorting\SortDefault.nls" at 03DC0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 663A0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\cryptbase.dll" at 75630000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\uxtheme.dll" at 741B0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" at 65940000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" at 69170000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" at 6C7E0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\shell32.dll" at 76170000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 75250000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\System32\cryptsp.dll" at 75140000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll" at 696E0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runt73a1fc9d#\fd0048cfdcd58dd454d2575e5cb55e70\System.Runtime.Remoting.ni.dll" at 68DE0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll" at 62300000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 046F0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\GdiPlus.dll" at 73FD0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Fonts\malgun.ttf" at 04BF0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Fonts\segoeui.ttf" at 008E0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Fonts\timesbd.ttf" at 04090000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Fonts\timesbi.ttf" at 01720000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\Fonts\MTCORSVA.TTF" at 007D000032:T49db,".exe" loaded module "GDI32.DLL" at base 77680000 ".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 729e0000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 ".exe" loaded module "KERNEL32" at base 77510000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6c7e0000 ".exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 ".exe" loaded module "USER32.DLL" at base 760a0000 ".exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 ".exe" loaded module "MSCOREE.DLL" at base 6cbd0000 ".exe" loaded module "PSAPI.DLL" at base 77980000 ".exe" loaded module "RPCRT4.DLL" at base 75ff0000 ".exe" loaded module "CRYPTBASE.DLL" at base 75630000 ".exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 741b0000 ".exe" loaded module "KERNEL32.DLL" at base 77510000 ".exe" loaded module "ADVAPI32.DLL" at base 776d0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 695b0000 ".exe" loaded module "NTDLL.DLL" at base 77830000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 ".exe" loaded module "BCRYPT.DLL" at base 75250000 ".exe" loaded module "IMM32.DLL" at base 75eb0000 ".exe" loaded module "COMCTL32.DLL" at base 6cc20000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 63f40000 ".exe" loaded module "OLEAUT32.DLL" at base 75e00000 ".exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77990000 ".exe" loaded module "RPCRTREMOTE.DLL" at base 756d0000 ".exe" loaded module "WINDOWSCODECS.DLL" at base 73da0000 ".exe" loaded module "PROPSYS.DLL" at base 74470000 ".exe" loaded module "OLE32.DLL" at base 77350000 ".exe" loaded module "COMCTL32.DLL" at base 745b0000 ".exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77510000 ".exe" loaded module "SHELL32.DLL" at base 76170000 ".exe" loaded module "NTMARTA.DLL" at base 74c50000 ".exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75790000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 ".exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75eb0000 ".exe" loaded module "SHLWAPI.DLL" at base 76dc0000 ".exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 ".exe" loaded module "VERSION.DLL" at base 74cb0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 68bb0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 677a0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 66d40000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 66520000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 66330000 ".exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6cb70000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6c5f0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 66180000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 65310000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 64b90000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6c530000 ".exe" loaded module "CRYPTSP.DLL" at base 75140000 ".exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74ed0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNT73A1FC9D#\FD0048CFDCD58DD454D2575E5CB55E70\SYSTEM.RUNTIME.REMOTING.NI.DLL" at base 64ac0000 ".exe" loaded module "UXTHEME.DLL" at base 741b0000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 642a0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 ".exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73fd0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 ".exe" loaded module "AMSI.DLL" at base 0 ".exe" loaded module "APPHELP.DLL" at base 755e0000 ".exe" loaded module "CLBCATQ.DLL" at base 775f0000 ".exe" loaded module "SETUPAPI.DLL" at base 771b0000 ".exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74470000 ".exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77060000 ".exe" loaded module "SECUR32.DLL" at base 75470000 ".exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 759d0000 ".exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 755e0000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 77510000 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 75630000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 741b0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 75ff0000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77990000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 776d0000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 775f0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73820000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 755c0000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 729e0000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "RegSvcs.exe" loaded module "KERNEL32" at base 77510000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "RegSvcs.exe" loaded module "ADVAPI32.DLL" at base 776d0000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6c7e0000 "RegSvcs.exe" loaded module "SHLWAPI.DLL" at base 76dc0000 "RegSvcs.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "RegSvcs.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "RegSvcs.exe" loaded module "VERSION.DLL" at base 74cb0000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 68bb0000 "RegSvcs.exe" loaded module "USER32.DLL" at base 760a0000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "RegSvcs.exe" loaded module "MSCOREE.DLL" at base 6cbd0000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "RegSvcs.exe" loaded module "PSAPI.DLL" at base 77980000 "RegSvcs.exe" loaded module "KERNEL32.DLL" at base 77510000 "RegSvcs.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 66390000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "RegSvcs.exe" loaded module "OLE32.DLL" at base 77350000 "RegSvcs.exe" loaded module "CRYPTBASE.DLL" at base 75630000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 741b0000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74360000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6cc20000 "RegSvcs.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 68150000 "RegSvcs.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 67fa0000 "RegSvcs.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 65520000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 72800000 "RegSvcs.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 64d00000 "RegSvcs.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 67e90000 "RegSvcs.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 64580000 "RegSvcs.exe" loaded module "NTDLL.DLL" at base 77830000 "RegSvcs.exe" loaded module "SHELL32.DLL" at base 76170000 "RegSvcs.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77990000 "RegSvcs.exe" loaded module "PROFAPI.DLL" at base 75740000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "RegSvcs.exe" loaded module "BCRYPT.DLL" at base 75250000 "RegSvcs.exe" loaded module "CRYPTSP.DLL" at base 75140000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74ed0000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "RegSvcs.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 69590000 "RegSvcs.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77990000 "RegSvcs.exe" loaded module "RPCRTREMOTE.DLL" at base 756d0000 "RegSvcs.exe" loaded module "OLEAUT32.DLL" at base 75e00000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f020000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "RegSvcs.exe" loaded module "SSPICLI.DLL" at base 755c0000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "RegSvcs.exe" loaded module "IMM32.DLL" at base 75eb0000 "RegSvcs.exe" loaded module "COMCTL32.DLL" at base 6c5f0000 "RegSvcs.exe" loaded module "GDI32.DLL" at base 77680000 "RegSvcs.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 67db0000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "RegSvcs.exe" loaded module "RPCRT4.DLL" at base 75ff0000 "RegSvcs.exe" loaded module "CLBCATQ.DLL" at base 775f0000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77510000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6f000000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6f3a0000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 727d0000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f4d0000 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "RegSvcs.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VAULTCLI.DLL" at base 0 "RegSvcs.exe" loaded module "VAULTCLI.DLL" at base 6cb60000 "DmLfWZhKpoh.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 729e0000 "DmLfWZhKpoh.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 68400000 "DmLfWZhKpoh.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "DmLfWZhKpoh.exe" loaded module "MSCOREE.DLL" at base 727d0000 "DmLfWZhKpoh.exe" loaded module "KERNEL32.DLL" at base 77510000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 663a0000 "DmLfWZhKpoh.exe" loaded module "CRYPTBASE.DLL" at base 75630000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 741b0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 65940000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 69170000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6c7e0000 "DmLfWZhKpoh.exe" loaded module "ADVAPI32.DLL" at base 776d0000 "DmLfWZhKpoh.exe" loaded module "SHELL32.DLL" at base 76170000 "DmLfWZhKpoh.exe" loaded module "BCRYPT.DLL" at base 75250000 "DmLfWZhKpoh.exe" loaded module "CRYPTSP.DLL" at base 75140000 "DmLfWZhKpoh.exe" loaded module "COMCTL32.DLL" at base 696e0000 "DmLfWZhKpoh.exe" loaded module "GDI32.DLL" at base 77680000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNT73A1FC9D#\FD0048CFDCD58DD454D2575E5CB55E70\SYSTEM.RUNTIME.REMOTING.NI.DLL" at base 68de0000 "DmLfWZhKpoh.exe" loaded module "UXTHEME.DLL" at base 741b0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 62300000 "DmLfWZhKpoh.exe" loaded module "NTDLL.DLL" at base 77830000 "DmLfWZhKpoh.exe" loaded module "GDIPLUS.DLL" at base 73fd0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "DmLfWZhKpoh.exe" loaded module "OLEAUT32.DLL" at base 75e00000 "DmLfWZhKpoh.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77990000 "DmLfWZhKpoh.exe" loaded module "AMSI.DLL" at base 0 "DmLfWZhKpoh.exe" loaded module "SHLWAPI.DLL" at base 76dc0000 "DmLfWZhKpoh.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "DmLfWZhKpoh.exe" loaded module "VERSION.DLL" at base 74cb0000 "DmLfWZhKpoh.exe" loaded module "KERNEL32" at base 77510000 "DmLfWZhKpoh.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "DmLfWZhKpoh.exe" loaded module "USER32.DLL" at base 760a0000 "DmLfWZhKpoh.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "DmLfWZhKpoh.exe" loaded module "RPCRT4.DLL" at base 75ff0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "DmLfWZhKpoh.exe" loaded module "OLE32.DLL" at base 77350000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 65120000 "DmLfWZhKpoh.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6e390000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 68fc0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 62b20000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 68eb0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 649a0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cbe0000 "DmLfWZhKpoh.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77990000 "DmLfWZhKpoh.exe" loaded module "PROFAPI.DLL" at base 75740000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74ed0000 "DmLfWZhKpoh.exe" loaded module "IMM32.DLL" at base 75eb0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 680a0000 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "DmLfWZhKpoh.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73fd0000 "DmLfWZhKpoh.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77510000 "DmLfWZhKpoh.exe" loaded module "RPCRTREMOTE.DLL" at base 756d000033:T765,"insert into Product (item , Quantity) values (@item, @Quantity)" (Source: ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin, Indicator: "insert into product (item , quantity) values (@item, @quantity)"), "insert into registration(FirstName, LastName, UserName, Password1 )values(@first, @last, @username, @password)" (Source: ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin, Indicator: "insert into registration(firstname, lastname, username, password1 )values(@first, @last, @username, @password)"), "select * from MakePurchase" (Source: ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin, Indicator: "select * from makepurchase"), "select * from MakePurchase where productId = '" (Source: ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin, Indicator: "select * from makepurchase where productid = '"), "select UserName Password1 from registration where UserName= '" (Source: 6000017-frmLogin~Button1_Click, Indicator: "select username, password1 from registration where username= '"), "insert into employees(FirstName, LastName, Gender, Contact, City, Address1, Email)values(@firstname, @lastname, @gender, @contact, @city, @address, @email)" (Source: 60000a7-frmEmployees~btnSave_Click, Indicator: "insert into employees(firstname, lastname, gender, contact, city, address1, email)values(@firstname, @lastname, @gender, @contact, @city, @address, @email)"), "select * from employees" (Source: 60000af-frmList~frmList_Load, Indicator: "select * from employees"), "select * from Product" (Source: 60000e0-FrmMakePurchase~FrmMakePurchase_Load, Indicator: "select * from product"), "insert into MakePurchase(item, unitPrice, Quantity, Date1, ProductID, EmpNo)values('" (Source: 60000e1-FrmMakePurchase~btnSave_Click, Indicator: "insert into makepurchase(item, unitprice, quantity, date1, productid, empno)values('")34:T1113,".exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") ".exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") ".exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") ".exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") ".exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") ".exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") ".exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") ".exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") ".exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") ".exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") ".exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") ".exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") ".exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") ".exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") ".exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") ".exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") ".exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") ".exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "RegSvcs.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "RegSvcs.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") "RegSvcs.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}") "RegSvcs.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}") "RegSvcs.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "RegSvcs.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "RegSvcs.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS")35:T953,"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "DmLfWZhKpoh.exe.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"36:T5c7,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "RegSvcs.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "RegSvcs.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "RegSvcs.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "RegSvcs.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "RegSvcs.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "DmLfWZhKpoh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "DmLfWZhKpoh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "DmLfWZhKpoh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "DmLfWZhKpoh.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN")37:T5bc,".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC7-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "")38:T5e8,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "")39:T9b8,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC7-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC7-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "")3a:T55e,".exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" ".exe" trying to touch file "C:\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to touch file "C:\Windows\system32\VERSION.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to touch file "C:\Windows\system32\ucrtbase_clr0400.dll"3b:T65b,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" ".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "RegSvcs.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "RegSvcs.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "RegSvcs.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "RegSvcs.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "RegSvcs.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "DmLfWZhKpoh.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "DmLfWZhKpoh.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "DmLfWZhKpoh.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "DmLfWZhKpoh.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll"3c:T4ce3,".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\system32\combase.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" ".exe" trying to access non-existent file "C:\RpcRtRemote.dll" ".exe" trying to access non-existent file "C:\Windows\system32\amsi.dll" ".exe" trying to access non-existent file "C:\imRYWfcblVJadeckzeYChpZeyBEe.dll" ".exe" trying to access non-existent file "C:\imRYWfcblVJadeckzeYChpZeyBEe.exe" ".exe" trying to access non-existent file "C:\PROPSYS.dll" ".exe" trying to access non-existent file "C:\apphelp.dll" ".exe" trying to access non-existent file "C:\schtasks.exe" ".exe" trying to access non-existent file "C:\ntmarta.dll" ".exe" trying to access non-existent file "C:\Secur32.dll" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" ".exe" trying to access non-existent file "C:\CRYPTBASE.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" ".exe" trying to access non-existent file "C:\CRYPTSP.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UXTHEME.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\MSCORRC.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\MSCORRC.DLL.DLL" ".exe" trying to access non-existent file "C:\WINDOWSCODECS.DLL" ".exe" trying to access non-existent file "C:\SSPICLI.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\NTDLL.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" ".exe" trying to access non-existent file "C:\RPCRTREMOTE.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\AMSI.DLL" ".exe" trying to access non-existent file "C:\IMRYWFCBLVJADECKZEYCHPZEYBEE.DLL" ".exe" trying to access non-existent file "C:\IMRYWFCBLVJADECKZEYCHPZEYBEE.EXE" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DMLFWZHKPOH.EXE" ".exe" trying to access non-existent file "C:\PROPSYS.DLL" ".exe" trying to access non-existent file "C:\APPHELP.DLL" ".exe" trying to access non-existent file "C:\SCHTASKS.EXE" ".exe" trying to access non-existent file "C:\NTMARTA.DLL" ".exe" trying to access non-existent file "C:\SECUR32.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" ".exe" trying to access non-existent file "C:\CRYPTSP.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL" ".exe" trying to access non-existent file "C:\WindowsCodecs.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" "schtasks.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "schtasks.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "schtasks.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "schtasks.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FLTLIB.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\system32\combase.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CRYPTBASE.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CRYPTSP.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RpcRtRemote.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SspiCli.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\System32\COMBASE.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CRYPTBASE.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\system32\wbem\NTDSAPI.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CRYPTSP.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\PSAPI.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RPCRTREMOTE.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vaultcli.dll" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SSPICLI.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\System32\wbem\NTDSAPI.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VAULTCLI.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\system32\combase.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\FLTLIB.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\CRYPTBASE.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\CRYPTSP.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\RPCRTREMOTE.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\System32\AMSI.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\System32\COMBASE.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UXTHEME.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\CRYPTBASE.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\CRYPTSP.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\RpcRtRemote.dll" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\system32\amsi.dll"3d:T1970,".exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to access non-existent file "C:\ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe.config" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\emyOW\" ".exe" trying to access non-existent file "C:\ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.INI" ".exe" trying to access non-existent file "C:\ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe.Local\" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" ".exe" trying to access non-existent file "C:\Windows\System32\schtasks.exe:Zone.Identifier" ".exe" trying to access non-existent file "C:\AD3B7FBAFB3B8778F1BA4CC5A02F9E5976BC93EEF018B83DC99EDD59A2360715.EXE.CONFIG" ".exe" trying to access non-existent file "C:\AD3B7FBAFB3B8778F1BA4CC5A02F9E5976BC93EEF018B83DC99EDD59A2360715.EXE.LOCAL" ".exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\EMYOW" ".exe" trying to access non-existent file "C:\AD3B7FBAFB3B8778F1BA4CC5A02F9E5976BC93EEF018B83DC99EDD59A2360715.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" ".exe" trying to access non-existent file "C:\Windows\System32\schtasks.exe:ZONE.IDENTIFIER" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "RegSvcs.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "RegSvcs.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\fdbfc246-3885c43431#\" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.INI" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe.Local\" "RegSvcs.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\UCBrowser\" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.INI" "RegSvcs.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "RegSvcs.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\FDBFC246-3885C43431#" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\REGSVCS.INI" "RegSvcs.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\REGSVCS.EXE.LOCAL" "RegSvcs.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\LOGINS.JSON" "RegSvcs.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\UCBROWSER" "RegSvcs.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\THE BAT!" "RegSvcs.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DISCORD" "RegSvcs.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DISCORDCANARY" "RegSvcs.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DISCORDPTB" "RegSvcs.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\SYSTEM.WEB.EXTENSIONS.INI" "RegSvcs.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS.SQLITE" "RegSvcs.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\CLAWS-MAIL" "RegSvcs.exe" trying to access non-existent file "C:\STORAGE" "RegSvcs.exe" trying to access non-existent file "C:\MAIL" "RegSvcs.exe" trying to access non-existent file "C:\ProgramData\FLASHFXP" "RegSvcs.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\FLASHFXP" "RegSvcs.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\NORDVPN" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DmLfWZhKpoh.exe.config" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\emyOW\" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DmLfWZhKpoh.INI" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DMLFWZHKPOH.EXE.CONFIG" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DMLFWZHKPOH.EXE.LOCAL" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DMLFWZHKPOH.INI" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DmLfWZhKpoh.exe.Local\" "DmLfWZhKpoh.exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config"3e:T1888,Heuristic match: "Sales_and_Inventory_System.My" Heuristic match: "YS#Q.ma" Heuristic match: "*,.VU" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "\Microsoft.NET" Heuristic match: "ing.SD" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/XMLSchema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#WithComments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/TR/1999/REC-xpath-19991116" Pattern match: "http://www.w3.org/TR/1999/REC-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#XML" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/XML/1998/namespace" Pattern match: "http://schemas.microsoft.com/.NetConfiguration/v2.0" Pattern match: "system.web/anonymousIdentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browserCaps" Pattern match: "system.web/clientTarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customErrors" Pattern match: "system.web/deployment" Pattern match: "system.web/deviceFilters" Pattern match: "system.web/fullTrustAssemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthMonitoring" Pattern match: "system.web/hostingEnvironment" Pattern match: "system.web/httpCookies" Pattern match: "system.web/httpHandlers" Pattern match: "system.web/httpModules" Pattern match: "system.web/httpRuntime" Pattern match: "system.web/identity" Pattern match: "system.web/machineKey" Pattern match: "system.web/membership" Pattern match: "system.web/mobileControls" Pattern match: "system.web/pages" Pattern match: "system.web/partialTrustVisibleAssemblies" Pattern match: "system.web/processModel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/roleManager" Pattern match: "system.web/securityPolicy" Pattern match: "system.web/sessionPageState" Pattern match: "system.web/sessionState" Pattern match: "system.web/siteMap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlMappings" Pattern match: "system.web/webControls" Pattern match: "system.web/webParts" Pattern match: "system.web/webServices" Pattern match: "system.web/xhtmlConformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputCache" Pattern match: "system.web/caching/outputCacheSettings" Pattern match: "system.web/caching/sqlCacheDependency" Pattern match: "http://schemas.microsoft.com/clr/" Pattern match: "http://schemas.microsoft.com/clr/assem/" Pattern match: "http://schemas.microsoft.com/clr/ns/" Pattern match: "http://schemas.microsoft.com/clr/nsassem/" Heuristic match: ".database.windows.net" Heuristic match: ".database.cloudapi.de" Heuristic match: ".database.usgovcloudapi.net" Heuristic match: ".database.chinacloudapi.cn" Heuristic match: ".N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.N.NF" Heuristic match: ".Http.Tr" Pattern match: "Microsoft.Net/assembly/GAC_32/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "

.exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\Temp\\VxSSL32.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\FLTLIB.DLL" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\FLTLIB.DLL"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\api-ms-win-core-synch-l1-2-0.DLL"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\SYSTEM32\\MSCOREE.DLL.local" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\api-ms-win-appmodel-runtime-l1-1-0.dll" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\VERSION.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ucrtbase_clr0400.dll" "$status": "c0000034"} ".exe" called "NtQueryAttributesFile" with parameters {"FileAttributes": "0" "$name": "C:\\Windows\\system32\\ucrtbase_clr0400.dll"}40:T78b,".exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004008) ".exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004008) ".exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004008) ".exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004008) ".exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004008) ".exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004008) ".exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004008) ".exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00004008) ".exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004008) ".exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004008) ".exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004008) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00004008) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004008) ".exe" called "FindNextFileW" with parameter 36eaccfde177c2e7b93b8dbdde4e012a (UID: 00000000-00004008) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\emyOW\* (UID: 00000000-00004008) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\* (UID: 00000000-00004008) ".exe" called "FindNextFileW" with parameter a891970b44db9e340c3ef3efa95b793c (UID: 00000000-00004008)41:Tab6,Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "ExecuteReader" in "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin" Observed namespace "System.Data.SqlClient.SqlDataReader" and TypeReference "get_HasRows" in "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "get_Parameters" in "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "AddWithValue" in "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "ExecuteNonQuery" in "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference ".ctor" in "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin" Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference "Open" in "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin" Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference "Close" in "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin" Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "DmLfWZhKpoh.exe.bin" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "DmLfWZhKpoh.exe.bin" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "ExecuteReader" in "DmLfWZhKpoh.exe.bin" Observed namespace "System.Data.SqlClient.SqlDataReader" and TypeReference "get_HasRows" in "DmLfWZhKpoh.exe.bin" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "get_Parameters" in "DmLfWZhKpoh.exe.bin" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "AddWithValue" in "DmLfWZhKpoh.exe.bin" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "ExecuteNonQuery" in "DmLfWZhKpoh.exe.bin" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference ".ctor" in "DmLfWZhKpoh.exe.bin" Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference "Open" in "DmLfWZhKpoh.exe.bin" Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference "Close" in "DmLfWZhKpoh.exe.bin"42:Tc3b,Found string "insert into registration(FirstName, LastName, UserName, Password1 )values(@first, @last, @username, @password)" (Indicator: "password"; File: "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin") Found string "@password" (Indicator: "password"; File: "ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin") Found string "Password1 )values(@first, @last, @username, @password)" (Indicator: "password"; File: "00000000-00004008.00000000.67692.00FD2000.00000020.mdmp") Found string "nsert into registration(FirstName, LastName, UserName, Password1 )values(@first, @last, @username, @password)" (Indicator: "password"; Source: "00000000-00002492.00000000.77475.000D2000.00000020.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00002492.00000000.77475.000D2000.00000020.mdmp, 00000000-00002492.00000000.77475.01B60000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00002492.00000000.77475.01B60000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00002492.00000000.77475.01B60000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00002492.00000000.77475.01B60000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00002492.00000000.77475.01B60000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00002492.00000000.77475.01B60000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00002492.00000000.77475.01B60000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00004008.00000000.67692.00260000.00000004.mdmp, 00000000-00004008.00000001.69408.00260000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00004008.00000000.67692.00260000.00000004.mdmp, 00000000-00004008.00000001.69408.00260000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00004008.00000000.67692.00260000.00000004.mdmp, 00000000-00004008.00000001.69408.00260000.00000004.mdmp") Found string "nsert into registration(FirstName, LastName, UserName, Password1 )values(@first, @last, @username, @password)" (Indicator: "password"; Source: "00000000-00004008.00000000.67692.00FD2000.00000020.mdmp, 00000000-00004008.00000001.69408.00FD2000.00000020.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00004008.00000000.67692.00FD2000.00000020.mdmp, 00000000-00004008.00000001.69408.00FD2000.00000020.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00004008.00000000.67692.01CD0000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00004008.00000000.67692.01CD0000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00004008.00000000.67692.01CD0000.00000004.mdmp")43:T4c5,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002492.00000000.77475.004C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004008.00000000.67692.00260000.00000004.mdmp, 00000000-00004008.00000001.69408.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00004008.00000001.69408.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00004008.00000001.69408.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00004008.00000001.69408.00260000.00000004.mdmp") Found string "\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004008.00000001.69408.00260000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00004008.00000001.69408.00260000.00000004.mdmp")44:T7ab,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET DATA PROVIDER FOR SQLSERVER\PERFORMANCE"; Key: "LIBRARY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET DATA PROVIDER FOR SQLSERVER\PERFORMANCE"; Key: "ISMULTIINSTANCE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET DATA PROVIDER FOR SQLSERVER\PERFORMANCE"; Key: "FIRST COUNTER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET DATA PROVIDER FOR SQLSERVER\PERFORMANCE"; Key: "CATEGORYOPTIONS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET DATA PROVIDER FOR SQLSERVER\PERFORMANCE"; Key: "FILEMAPPINGSIZE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET DATA PROVIDER FOR SQLSERVER\PERFORMANCE"; Key: "COUNTER NAMES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "RegSvcs.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")45:T1401,".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "16" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "303104" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "12" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "872448" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\mscoree.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "12" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "307200" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\mscoree.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "12" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "1048576" "InheritDisposition": "2" "AllocationType": "4194304" "Protect": "2" "$name": "C:\\Windows\\System32\\mscoree.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "28" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "659456" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\sechost.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "52" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "286720" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\imm32.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "48" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "217088" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "\\FileSystem\\Filters\\FltMgrMsg"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "48" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "24576" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "\\FileSystem\\Filters\\FltMgrMsg"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "52" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "28672" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\imm32.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "52" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "12288" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\imm32.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "52" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "839680" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4" "$name": "C:\\Windows\\System32\\imm32.dll"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "120" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "356352" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "132" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "36864" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "132" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "8056832" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "132" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "700416" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "172" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "4096" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "176" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "65536" "InheritDisposition": "1" "AllocationType": "0" "Protect": "4"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "352" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "2945024" "InheritDisposition": "1" "AllocationType": "0" "Protect": "2"} ".exe" called "NtMapViewOfSection" with parameters {"SectionHandle": "436" "ProcessHandle": "4294967295" "ZeroBits": "0" "CommitSize": "0" "ViewSize": "380928" "InheritDisposition": "1" "AllocationType": "0" "Protect": "2"}46:T1a8b,".exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000060b4280074f74500145c8877435c887740f84500010000009401260001000000f4f64500935c897740839077d4a088772267c57740f84500010000000100000080c0280000000000c4f64500f4f6450060f7450095e184772e950800feffffffd4a088771bbe82750000f27500000000 (UID: 00000000-00004008) ".exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6887782749f77f42ec96c00d22800a035c96cf2749f777ce51f0020872800b2f48877e2749f778ce51f000000c26c0000c26c00000000e8e41f00f0000000f000c26c00000000f8e41f00530000008ce61f0000000000010000005ce51f0040f58877000000000000000048e51f00 (UID: 00000000-00004008) ".exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebf07538e331000070fd7f9a5c897700f0fd7fe89a1f004470fd7f00000000400000003f0000002c0000000070fd7fdc9a1f00c15c8977608290772c0000000070fd7f9a5c897700f0fd7f009b1f00578988778083907713178375d8ebf075 (UID: 00000000-00004008) ".exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004008) ".exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004008) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100352c323736382c332c647750726f6365737349642c302c302c2c3663630d0a00656c33322e646c6c2c223235323a30333a33392e353331222c52583d302c50583d300030303030306231316430303030303230303030303035333030363530303732303037363030363930303633303036 (UID: 00000000-00001740) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f244e075bc764977e09c380010fa3700e49c3800e09c380030000000000000005cee210050dce475e09c38003000000000000000bc5fcd01300000000200000000000000180000004557859a84ee21002823726900003000000000000c00000028c74e6f90ee21002f997d720c000000 (UID: 00000000-00001740) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000030ef21006a6fca6800000000bc6fca68a5aefeb0acea210000000000b0f0210015de0076b985ddc6feffffff7f670876e2d848772824026f02000000000000001800000030a57d72f0ee21002823726900003000000000000c00000030a57d72fcee21002f997d720c000000 (UID: 00000000-00001740) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000bd3b002cf4dd0453a8886c00bd3b000000000038f4dd044845886c00bd3b0078f4dd048b3c876c00bd3b00200000002812dc012002e3012812dc0102000000000000001800000000bd3b007cf4dd042823726900003000000000000c0000002002e30188f4dd042f997d720c000000 (UID: 00000000-00001740) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f244e075bc764977a0523c0010fa3700a4523c00a0523c0030000000000000005cee210050dce475a0523c003000000000000000fc6dcd01300000000200000000000000180000004557859a84ee21002823726900003000000000000c00000028c74e6f90ee21002f997d720c000000 (UID: 00000000-00001740) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000100000008ef21006a6fca6800000000bc6fca688daefeb084ea210000000000b0f0210015de0076b985ddc6feffffff7f670876e2d848772824026f02000000000000001800000030a57d72c8ee21002823726900003000000000000c00000030a57d72d4ee21002f997d720c000000 (UID: 00000000-00001740) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000050c23b009cf5df0453a8886c50c23b0000000000a8f5df044845886c50c23b00e8f5df048b3c876c50c23b00200000002812dc012082e3012812dc0102000000000000001800000050c23b00ecf5df042823726900003000000000000c0000002082e301f8f5df042f997d720c000000 (UID: 00000000-00001740) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f244e075bc7649776060390010fa37006460390060603900800000000000000038ee210050dce4756060390050000000000000008c6fcd0150000000020000000000000018000000a157859a60ee21002823726900003000000000000c00000028c74e6f6cee21002f997d720c000000 (UID: 00000000-00001740) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f68877f4e1a177f42e666c309d3200a035666cc4e1a177a4ea2100486c3200b2f48877d4e1a177b4ea210000005f6c00005f6c0000000010ea2100f0000000f0005f6c0000000020ea210053000000b4eb2100000000000100000084ea210040f58877000000000000000070ea2100 (UID: 00000000-00001740) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100b498f4b604b29c397734377d7200000000010000000000000001000000bcf4b604000000002812dc01f8f4b604e89d3b00c8f4b6048f9c397734377d7202000000000000001800000001000000ccf4b6042823726900003000000000000c00000060c2e201d8f4b6042f997d720c000000 (UID: 00000000-00001740) "DmLfWZhKpoh.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310022f5f688771603b677f42e7569b0c64e00a03575696603b677fce73400d86b4e00b2f488777603b6770ce8340000006e6900006e690000000068e73400f0000000f0006e690000000078e73400530000000ce934000000000001000000dce7340040f588770000000000000000c8e73400 (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100647750726f6365737349642c302c302c2c3962630d0a00656c33322e646c6c2c223235323a30383a34302e363430222c52583d302c50583d300030303030306231316430303030303230303030303035333030363530303732303037363030363930303633303036353030323030303530 (UID: 00000000-00002492) "DmLfWZhKpoh.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002492)47:T4c3,"1.0.0.0" "11.0.0.0" "16.0.0.0" Potential IP "16.10.0.0" found in string "KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator 16.10.0.0" Potential IP "4.0.0.0" found in string "em.Windows.Forms,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "g,4.0.0.0,,b77a5c561" "192.168.242.37" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowLocation="false" />", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 Cultu", Potential IP "4.0.0.0" found in string "n=4.0.0.0 C", Potential IP "4.0.0.0" found in string "4.0.0.0 Cul", Potential IP "4.0.0.0" found in string "=4.0.0.0 Cu", Potential IP "4.0.0.0" found in string "ersion=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089" />" "2.5.29.10" "2.5.29.19" "2.5.29.14" "2.5.29.15" "2.5.29.37" "127.0.0.1" "10.0.0.0" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neu" Potential IP "4.0.0.0" found in string "=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />", Potential IP "4.0.0.0" found in string "em.Runtime.Caching 4.0.0.0 b03f5f7f11d50a3a MSIL", Potential IP "4.0.0.0" found in string "n=4.0.0.0 ?", "4.0.0.0"48:T660,"RegSvcs.exe" opened file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "RegSvcs.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\FILEZILLA\RECENTSERVERS.XML" "RegSvcs.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\SMARTFTP\CLIENT 2.0\FAVORITES\QUICK CONNECT" "RegSvcs.exe" opened file "C:\Users\%OSUSER%\AppData\ROAMINGIPSWITCH\WS_FTP\SITES\WS_FTP.INI" "RegSvcs.exe" opened file "C:\PROGRAM FILES (X86)\FTP COMMANDER DELUXE\FTPLIST.TXT" "RegSvcs.exe" opened file "C:\PROGRAM FILES (X86)\FTP COMMANDER\FTPLIST.TXT" "RegSvcs.exe" opened file "C:\CFTP\FTPLIST.TXT" "RegSvcs.exe" opened file "C:\Users\%OSUSER%\AppData\Local\VirtualStore\PROGRAM FILES (X86)\FTP COMMANDER\FTPLIST.TXT" "RegSvcs.exe" opened file "C:\Users\%OSUSER%\AppData\Local\VirtualStore\PROGRAM FILES (X86)\FTP COMMANDER DELUXE\FTPLIST.TXT" "RegSvcs.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\FTPGETTER\SERVERS.XML" "RegSvcs.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\POCOMAIL\ACCOUNTS.INI" "RegSvcs.exe" opened file "C:\FTP NAVIGATOR\FTPLIST.TXT" "RegSvcs.exe" opened file "%LOCALAPPDATA%\MAPLESTUDIO\CHROMEPLUS\USER DATA" "RegSvcs.exe" opened file "%APPDATA%\FILEZILLA\RECENTSERVERS.XML" "RegSvcs.exe" opened file "%APPDATA%\SMARTFTP\CLIENT 2.0\FAVORITES\QUICK CONNECT" "RegSvcs.exe" opened file "%APPDATA%\PSWITCH\WS_FTP\SITES\WS_FTP.INI" "RegSvcs.exe" opened file "%PROGRAMFILES%\(X86)\FTP COMMANDER DELUXE\FTPLIST.TXT" "RegSvcs.exe" opened file "%PROGRAMFILES%\(X86)\FTP COMMANDER\FTPLIST.TXT" "RegSvcs.exe" opened file "%LOCALAPPDATA%\VirtualStore\PROGRAM FILES (X86)\FTP COMMANDER\FTPLIST.TXT"49:T4e2,"RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\OPERA MAIL\OPERA MAIL\WAND.DAT" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\THUNDERBIRD\PROFILES.INI" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\POSTBOX\PROFILES.INI" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\CLAWS-MAIL" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VirtualStore\PROGRAM FILES\FOXMAIL\MAIL" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VirtualStore\PROGRAM FILES (X86)\FOXMAIL\MAIL" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\POCOMAIL\ACCOUNTS.INI" "RegSvcs.exe" trying to open a file "%APPDATA%\OPERA MAIL\OPERA MAIL\WAND.DAT" "RegSvcs.exe" trying to open a file "%APPDATA%\THUNDERBIRD\PROFILES.INI" "RegSvcs.exe" trying to open a file "%APPDATA%\POSTBOX\PROFILES.INI" "RegSvcs.exe" trying to open a file "%APPDATA%\CLAWS-MAIL" "RegSvcs.exe" trying to open a file "%LOCALAPPDATA%\VirtualStore\PROGRAM FILES\FOXMAIL\MAIL" "RegSvcs.exe" trying to open a file "%LOCALAPPDATA%\VirtualStore\PROGRAM FILES (X86)\FOXMAIL\MAIL" "RegSvcs.exe" trying to open a file "%APPDATA%\POCOMAIL\ACCOUNTS.INI"4a:T6d9,".exe" wrote bytes "00000000" to virtual address "0x05B87938" ".exe" wrote bytes "ef83d07b" to virtual address "0x68BBF798" (part of module "CLR.DLL") ".exe" wrote bytes "00000000" to virtual address "0x05B87970" ".exe" wrote bytes "00000000" to virtual address "0x05B87990" ".exe" wrote bytes "00000000" to virtual address "0x05B879B0" ".exe" wrote bytes "0000000000000000" to virtual address "0x05B20178" ".exe" wrote bytes "00000000" to virtual address "0x05B87974" ".exe" wrote bytes "00000000" to virtual address "0x05B87994" ".exe" wrote bytes "00000000" to virtual address "0x05B879B4" ".exe" wrote bytes "0000000000000000" to virtual address "0x05B201A0" ".exe" wrote bytes "6e74646c6c2e646c6c0000" to virtual address "0x05BBBEAE" ".exe" wrote bytes "00000000" to virtual address "0x05B879A0" ".exe" wrote bytes "00000000" to virtual address "0x05B879C0" ".exe" wrote bytes "4e74436f6e74696e756500" to virtual address "0x05BBBEA2" ".exe" wrote bytes "0000000000000000" to virtual address "0x05B201C8" ".exe" wrote bytes "00000000000000000000000000000000030000003c040006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" to virtual address "0x05B20208" ".exe" wrote bytes "00000000" to virtual address "0x05B87964" ".exe" wrote bytes "00000000" to virtual address "0x05B87984" ".exe" wrote bytes "00000000" to virtual address "0x05B879A4" ".exe" wrote bytes "00000000" to virtual address "0x05B879C4"4b:T4db,".exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 1088) ".exe" wrote 1500 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 984) ".exe" wrote 4 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 984) ".exe" wrote 32 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 984) ".exe" wrote 52 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 984) ".exe" wrote 512 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 984) ".exe" wrote 165888 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 984) ".exe" wrote 1536 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 984) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 1088) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 1088)4c:T630,"RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "EMAIL") "RegSvcs.exe" (Path: "HKCU\SOFTWARE\INCREDIMAIL\IDENTITIES")4d:Tfd3,"RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBrowser\" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SPUTNIK\SPUTNIK\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCOZMEDIA\URAN\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\LIEBAO\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ELEMENTS BROWSER\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\FENRIR INC\SLEIPNIR5\SETTING\MODULES\CHROMIUMVIEWER" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\QIP SURF\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GOOGLE\CHROME\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\EDGE\USER DATA" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\LOGINS.JSON" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBROWSER" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\TRILLIAN\USERS\GLOBAL\ACCOUNTS.DAT" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS.SQLITE" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\SEAMONKEY\PROFILES.INI" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\THUNDERBIRD\PROFILES.INI" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\NETGATE TECHNOLOGIES\BLACKHAWK\PROFILES.INI" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\8PECXSTUDIOS\CYBERFOX\PROFILES.INI" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\K-MELEON\PROFILES.INI" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\ICECAT\PROFILES.INI" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\MOONCHILD PRODUCTIONS\PALE MOON\PROFILES.INI" "RegSvcs.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\COMODO\ICEDRAGON\PROFILES.INI"4e:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC4f:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790270432160,"unified_at":"2026-09-24T17:20:32.160Z","metadata":{"hashes":{"sha256":"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715","sha1":"70a35f2b84af49af0f8ac8194ef843f961f82515","md5":"a38024795922db25d2234ada487f3253","sha512":"4bb8e35204be0c59443a894764e7c6ce076bd2b5c87b4f9efe1575360879a41bef9272972e696a52dd2ddffbbeb0547ff41112d8f57bc0ab3a82161ba465ad2a","ssdeep":"12288:4PZ0vvsj2jKp626jZFA3c2vYSBzBfVH+avq/BW3vMZJ9Y9uc1p:UeXs6jKr+ZFAsPSBdaBW3k58uc","ssdeep_chunks":["12288:4PZ0vvs","12288:PZ0vvsj","12288:Z0vvsj2","12288:0vvsj2j","12288:vvsj2jK","12288:vsj2jKp","12288:sj2jKp6","12288:j2jKp62","12288:2jKp626","12288:jKp626j","12288:Kp626jZ","12288:p626jZF","12288:626jZFA","12288:26jZFA3","12288:6jZFA3c","12288:jZFA3c2","12288:ZFA3c2v","12288:FA3c2vY","12288:A3c2vYS","12288:3c2vYSB","12288:c2vYSBz","12288:2vYSBzB","12288:vYSBzBf","12288:YSBzBfV","12288:SBzBfVH","12288:BzBfVH+","12288:zBfVH+a","12288:BfVH+av","12288:fVH+avq","12288:VH+avq/","12288:H+avq/B","12288:+avq/BW","12288:avq/BW3","12288:vq/BW3v","12288:q/BW3vM","12288:/BW3vMZ","12288:BW3vMZJ","12288:W3vMZJ9","12288:3vMZJ9Y","12288:vMZJ9Y9","12288:MZJ9Y9u","12288:ZJ9Y9uc","12288:J9Y9uc1","12288:9Y9uc1p","24576:4PZ0vvs","24576:PZ0vvsj","24576:Z0vvsj2","24576:0vvsj2j","24576:vvsj2jK","24576:vsj2jKp","24576:sj2jKp6","24576:j2jKp62","24576:2jKp626","24576:jKp626j","24576:Kp626jZ","24576:p626jZF","24576:626jZFA","24576:26jZFA3","24576:6jZFA3c","24576:jZFA3c2","24576:ZFA3c2v","24576:FA3c2vY","24576:A3c2vYS","24576:3c2vYSB","24576:c2vYSBz","24576:2vYSBzB","24576:vYSBzBf","24576:YSBzBfV","24576:SBzBfVH","24576:BzBfVH+","24576:zBfVH+a","24576:BfVH+av","24576:fVH+avq","24576:VH+avq/","24576:H+avq/B","24576:+avq/BW","24576:avq/BW3","24576:vq/BW3v","24576:q/BW3vM","24576:/BW3vMZ","24576:BW3vMZJ","24576:W3vMZJ9","24576:3vMZJ9Y","24576:vMZJ9Y9","24576:MZJ9Y9u","24576:ZJ9Y9uc","24576:J9Y9uc1","24576:9Y9uc1p","12288:UeXs6jK","12288:eXs6jKr","12288:Xs6jKr+","12288:s6jKr+Z","12288:6jKr+ZF","12288:jKr+ZFA","12288:Kr+ZFAs","12288:r+ZFAsP","12288:+ZFAsPS","12288:ZFAsPSB","12288:FAsPSBd","12288:AsPSBda","12288:sPSBdaB","12288:PSBdaBW","12288:SBdaBW3","12288:BdaBW3k","12288:daBW3k5","12288:aBW3k58","12288:BW3k58u","12288:W3k58uc"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"DHL.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1009152,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1683651617000,"last_seen":1683655028000,"last_multi_scan":1683655028000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":63},"sandbox_signatures":{"informative_count":124,"suspicious_count":15,"malicious_count":13,"total":152},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.FQW.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.PwStealer.bi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains NTDLL native APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API during runtime"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"Queries COM task scheduler class object"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Loaded modules"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Persistence","technique":"Hijack Execution Flow","attack_id":"T1574","attack_id_wiki":"https://attack.mitre.org/techniques/T1574","identifiers":[{"type":"informative","value":"Loaded EXE module from outside of Windows folder"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Calls an API typically used to map section into the virtual address space of a process"},{"type":"informative","value":"Allocates virtual memory in a self process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to opens the access token associated with a process"},{"type":"informative","value":"Calls an API typically used to opens the access token associated with a thread"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"},{"type":"informative","value":"Calls an API typically used to unmap view of a section from a process"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"Regsvcs/Regasm","attack_id":"T1218.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/009","identifiers":[{"type":"informative","value":"Detected regasm.exe/regsvcs.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","identifiers":[{"type":"informative","value":"Possibly use system binaries (Windows LOLbins)"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Credential Access","technique":"Credentials in Registry","attack_id":"T1552.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/002","identifiers":[{"type":"malicious","value":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically to used to retrieve file or directory information"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"suspicious","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic process information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"malicious","value":"Reads FTP client related registry keys"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to create string binding handle (RPC)"},{"type":"informative","value":"Calls an API typically used to register protocol sequence (RPC)"},{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes file in a temporary directory"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May executes SQL queries"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal FTP credentials from registry"},{"type":"suspicious","value":"Checks on FTP client related files"},{"type":"suspicious","value":"Tries to steal VPN information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"suspicious","value":"Tries to access mail clients information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Contains ability to perform sql operations (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Writes files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Contains ability to copy files"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"suspicious","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"References web dev"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API typically used to terminate process and its threads"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin\"\n Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"DmLfWZhKpoh.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002492.00000000.77475.01B60000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002492.00000000.77475.01B60000.00000004.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004008.00000000.67692.01CD0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00004008.00000000.67692.01CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00004008)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" (UID: 00000000-00004008)\n \".exe\" called \"IsWow64Process\" with parameter \"4008\" - (UID: 00000000-00004008)\n \"schtasks.exe\" called \"IsWow64Process\" with parameter \"384\" - (UID: 00000000-00000384)\n \"RegSvcs.exe\" called \"IsWow64Process\" with parameter \"1740\" - (UID: 00000000-00001740)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004008)\n \".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00004008)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\".exe\" called \"OpenMutexW\" with parameter \"Global\\.net data provider for sqlserver\" - (UID: 00000000-00004008)\n \".exe\" called \"OpenMutexW\" with parameter \"LHxaAbnaLJqHrzoSp\" - (UID: 00000000-00004008)\n \"DmLfWZhKpoh.exe\" called \"OpenMutexW\" with parameter \"Global\\.net data provider for sqlserver\" - (UID: 00000000-00002492)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00000384)\n \"RegSvcs.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00001740)\n \"DmLfWZhKpoh.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00002492)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004008)\n \".exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004008)\n \"DmLfWZhKpoh.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002492)\n \"DmLfWZhKpoh.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002492)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"select * from MakePurchase\" (Indicator: \"select * from \"; File: \"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin\")\n Found string \"select * from MakePurchase where productId = '\" (Indicator: \"select * from \"; File: \"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin\")\n Found string \"select * from employees\" (Indicator: \"select * from \"; File: \"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin\")\n Found string \"select * from Product\" (Indicator: \"select * from \"; File: \"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"schtasks.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"RegSvcs.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"DmLfWZhKpoh.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"QuerySystemInformationW\" (Indicator: \"QuerySystemInformation\"; Source: \"00000000-00004008.00000001.69408.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindow\" (Indicator: \"FindWindow\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \",3024,,RtlGetVersion,NTDLL.d\" (Indicator: \"GetVersion\"; Source: \"00000000-00004008.00000001.69408.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"RegSvcs.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"DmLfWZhKpoh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"RegSvcs.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"DmLfWZhKpoh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Calls an API during runtime","description":"\".exe\" called \"NtCreateSection\" (PID: 4008) (UID: 00000000-00004008)\n \".exe\" called \"NtMapViewOfSection\" (PID: 4008) (UID: 00000000-00004008)\n \".exe\" called \"NtDelayExecution\" (PID: 4008) (UID: 00000000-00004008)\n \".exe\" called \"NtProtectVirtualMemory\" (PID: 4008) (UID: 00000000-00004008)\n \".exe\" called \"NtOpenSection\" (PID: 4008) (UID: 00000000-00004008)\n \".exe\" called \"NtQuerySystemInformation\" (PID: 4008) (UID: 00000000-00004008)\n \".exe\" called \"NtConnectPort\" (PID: 4008) (UID: 00000000-00004008)\n \".exe\" called \"NtQueryInformationProcess\" (PID: 4008) (UID: 00000000-00004008)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-265","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00004008)\n \".exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00004008)\n \".exe\" called \"CreateDirectoryW\" (UID: 00000000-00004008)\n \"RegSvcs.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00001740)\n \"DmLfWZhKpoh.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00002492)\n \"DmLfWZhKpoh.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00002492)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessW\" with parameter \"\"{path}\"\" - (UID: 00000000-00004008)\n \".exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /Create /TN \"Updates\\DmLfWZhKpoh\" /XML \"%TEMP%\\tmp7DAE.tmp\"\" - (UID: 00000000-00004008)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"Found reference to native API (Indicator: \"NtUnmapViewOfSection\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")\n Found reference to native API (Indicator: \"NtContinue\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"emyOW.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")\n Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")\n Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \":\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00004008.00000001.69408.00260000.00000004.mdmp\n 00000000-00004008.00000001.69408.0599A000.00000004.mdmp\n \":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00004008.00000001.69408.00260000.00000004.mdmp\n 00000000-00004008.00000001.69408.0599A000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\.net data provider for sqlserver\"\n \"LHxaAbnaLJqHrzoSp\"\n \"Global\\.net data provider for sqlserver\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\LHxaAbnaLJqHrzoSp\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Detected regasm.exe/regsvcs.exe process execution","description":"Process \"RegSvcs.exe\" with commandline \"\"{path}\"\" (UID: 00000000-00001740)","origin":"Monitored Target","mitre_attack_id":"T1218.009","relevance":3,"id":"target-216","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"DmLfWZhKpoh.exe.bin\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$30","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Loaded EXE module from outside of Windows folder","description":"\".exe\" loaded module \"C:\\ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe\" at 00FD0000\n \".exe\" loaded module \"C:\\ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe\" at 00360000\n \"DmLfWZhKpoh.exe\" loaded module \"%APPDATA%\\DmLfWZhKpoh.exe\" at 000D0000\n \"DmLfWZhKpoh.exe\" loaded module \"%APPDATA%\\DmLfWZhKpoh.exe\" at 00350000","origin":"Loaded Module","mitre_attack_id":"T1574","relevance":1,"id":"module-13","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Loaded modules","description":"$31","origin":"Loaded Module","mitre_attack_id":"T1574.002","id":"module-11","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 677A0000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 66390000\n \"DmLfWZhKpoh.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 663A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75250000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75250000\n \"DmLfWZhKpoh.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75250000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68400000\n \".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68BB0000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68BB0000\n \"DmLfWZhKpoh.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68BB0000\n \"DmLfWZhKpoh.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68400000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75FF0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75FF0000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75FF0000\n \"DmLfWZhKpoh.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75FF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"10001100da02c16c@ADVAPI32.dll\"\n \"0d000e0084d5bb6c@ADVAPI32.dll\"\n \"14001500c4d5bb6c@ADVAPI32.dll\"\n \"14001500dcd5bb6c@ADVAPI32.dll\"\n \"0c000d0024d6bb6c@ADVAPI32.dll\"\n \"0c000d0034d6bb6c@ADVAPI32.dll\"\n \"0e000f0044d6bb6c@ADVAPI32.dll\"\n \"18001900acd7bb6c@RPCRT4.dll\"\n \"13001400d8d7bb6c@RPCRT4.dll\"\n \"14001500ecd7bb6c@RPCRT4.dll\"\n \"1600170004d8bb6c@RPCRT4.dll\"\n \"0b000c0068d1bb6c@WS2_32.dll\"\n \"1b001c00381f7e6c@api-ms-win-core-synch-l1-2-0.DLL\"\n \"150016003cbabb6c@ADVAPI32.dll\"\n \"0e000f00b4babb6c@ADVAPI32.dll\"\n \"0e000f00e8babb6c@ADVAPI32.dll\"\n \"1100120048bfbb6c@ADVAPI32.dll\"\n \"11001200b4bfbb6c@ADVAPI32.dll\"\n \"12001300c8bfbb6c@ADVAPI32.dll\"\n \"12001300f0bfbb6c@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin\" was detected as \".NET\" and name: \"Library\"\n \"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"DmLfWZhKpoh.exe.bin\" was detected as \".NET\" and name: \"Library\"\n \"DmLfWZhKpoh.exe.bin\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"DmLfWZhKpoh.exe.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"May executes SQL queries","description":"$33","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$34","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"DmLfWZhKpoh.exe.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"DmLfWZhKpoh.exe.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin\" has an executable section named \".text\"\n \"DmLfWZhKpoh.exe.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$35","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Possibly use system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" [Source: 00000000-00004008-00000C3A-28022965646]\n Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00004008-00000C3A-18446744059616118871]\n Observed system executable string:\"\"%WINDIR%\\System32\\schtasks.exe\" /Create /TN \"Updates\\DmLfWZhKpoh\" /XML \"%TEMP%\\tmp7DAE.tmp\"\" [Source: 00000000-00004008-00000C3A-18446744059616118871]","origin":"File/Memory","mitre_attack_id":"T1218","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"DmLfWZhKpoh.exe\" (UID: 00000000-00002492) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"DmLfWZhKpoh.exe\" (UID: 00000000-00002492) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$36","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\DmLfWZhKpoh\" /XML \"%TEMP%\\\\tmp7DAE.tmp\"\" (UID: 00000000-00000384)\n Spawned process \"RegSvcs.exe\" with commandline \"\"{path}\"\" (UID: 00000000-00001740)\n Spawned process \"DmLfWZhKpoh.exe\" (UID: 00000000-00002492)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\DmLfWZhKpoh\" /XML \"%TEMP%\\\\tmp7DAE.tmp\"\" (UID: 00000000-00000384)\n Spawned process \"RegSvcs.exe\" with commandline \"\"{path}\"\" (UID: 00000000-00001740)\n Spawned process \"DmLfWZhKpoh.exe\" (UID: 00000000-00002492)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DmLfWZhKpoh.exe.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"General","name":"Writes file in a temporary directory","description":"\".exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmp7DAE.tmp\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Allocates virtual memory in a self process","description":"\".exe\" allocated memory in \"C:\\ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe\" with (Protection: \"read/write\")\n \".exe\" allocated memory in \"C:\\ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe\" with (Protection: \"execute/read/write\")\n \".exe\" allocated memory in \"C:\\ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe\" with (Protection: \"no access\")","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-262","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"RegSvcs.exe\" connecting to \"\\ThemeApiPort\"\n \"DmLfWZhKpoh.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"schtasks.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"RegSvcs.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"DmLfWZhKpoh.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]\n \"tmp7DAE.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\"- Location: [%TEMP%\\tmp7DAE.tmp]- [targetUID: 00000000-00004008]\n \"DmLfWZhKpoh.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\DmLfWZhKpoh.exe]- [targetUID: 00000000-00004008]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"tmp7DAE.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [%TEMP%\\tmp7DAE.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"tmp7DAE.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [%TEMP%\\tmp7DAE.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries COM task scheduler class object","description":"$38","origin":"Registry Access","mitre_attack_id":"T1053","relevance":3,"id":"registry-141","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic process information of the specified process","description":"\"RegSvcs.exe\" queries basic process information of the \"C:\\Windows\\System32\\cryptsp.dll\" (UID: 1740)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\".exe\" called \"NtQueueApcThread\" (UID: 00000000-00004008)\n \"DmLfWZhKpoh.exe\" called \"NtQueueApcThread\" (UID: 00000000-00002492)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\".exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \".exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\f7568d7f1b9d356f64779b4c0927cfb3\\system.drawing.ni.dll.aux\"\n \".exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.data\\b9463297e0537784be981f4d68498abc\\system.data.ni.dll.aux\"\n \".exe\" reads file \"c:\\ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe\"\n \".exe\" reads file \"c:\\users\\%osuser%\\desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Tries to sleep for a long time (more than two minutes)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\".exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\dmlfwzhkpoh.exe\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\tmp7dae.tmp\"\n \"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe\" writes file \"%temp%\\tmp7dae.tmp\"\n \"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe\" writes file \"%appdata%\\dmlfwzhkpoh.exe\"","origin":"API Call","mitre_attack_id":"T1105","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create string binding handle (RPC)","description":"\".exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00004008)\n \"schtasks.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00000384)\n \"RegSvcs.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00001740)\n \"DmLfWZhKpoh.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00002492)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-218","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\".exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004008)\n \"RegSvcs.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001740)\n \"DmLfWZhKpoh.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002492)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register protocol sequence (RPC)","description":"\".exe\" called \"RpcServerUseProtseqEpW\" with parameter ncalrpc & OLECD02CAFD9CCE4465A26756DF607B (UID: 00000000-00004008)\n \"RegSvcs.exe\" called \"RpcServerUseProtseqEpW\" with parameter ncalrpc & OLE6BD2DD172E07438BB364B36A1C20 (UID: 00000000-00001740)\n \"DmLfWZhKpoh.exe\" called \"RpcServerUseProtseqEpW\" with parameter ncalrpc & OLE179E529A869B4FA8B270490246EE (UID: 00000000-00002492)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-220","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"Copy\" (Indicator: \"copy\") in Source: 00000000-00004008.00000001.69408.05B20000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\";mx.%+\" [Source: 00000000-00004008.00000001.69408.05B20000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00002492.00000000.77475.004C0000.00000004.mdmp\")\n Found URL \"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead\" - Source: \"00000000-00002492.00000000.77475.01B60000.00000004.mdmp\")\n Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00004008.00000000.67692.00260000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00004008\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE179E529A869B4FA8B270490246EE]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002492.00000000.77475.004C0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLECD02CAFD9CCE4465A26756DF607B]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004008.00000001.69408.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\".exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00004008)\n \"DmLfWZhKpoh.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00002492)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically to used to retrieve file or directory information","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-236","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00004008)\n \"RegSvcs.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00001740)\n \"DmLfWZhKpoh.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002492)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a process","description":"\".exe\" called \"NtOpenProcessToken\" (UID: 00000000-00004008)","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-196","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a thread","description":"\".exe\" called \"NtOpenThreadToken\" (UID: 00000000-00004008)","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-197","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00004008)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\".exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"32daa0\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")\n Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to perform sql operations (Dotnet)","description":"$41","origin":"Static Parser","mitre_attack_id":"T1213","relevance":1,"id":"static-175","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributes\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where item ='\" (Indicator: \"where \"; Source: \"00000000-00002492.00000000.77475.000D2000.00000020.mdmp\")\n Found string \"where item ='\" (Indicator: \"where \"; Source: \"00000000-00004008.00000000.67692.00FD2000.00000020.mdmp, 00000000-00004008.00000001.69408.00FD2000.00000020.mdmp\")\n Found string \"where Stt = @stt\" (Indicator: \"where \"; Source: \"00000000-00004008.00000001.69408.005C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \",3024,,RtlGetVersion,NTDLL.d\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004008.00000001.69408.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames (API string)","description":"Found reference to API \"GetUserName\" (Indicator: \"GetUserName\"; Source: \"00000000-00004008.00000001.69408.05B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$42","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"%APPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00001740-00000C21-13423558769\")\n \"%LOCALAPPDATA%\\Microsoft\\Credentials\\*\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00001740-00000C21-18446744045190107659\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References web dev","description":"Found string \"ystem.WebDavPath\" (Indicator: \"webdav\"; Source: \"00000000-00004008.00000001.69408.00F50000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-476","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\".exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004008)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to terminate process and its threads","description":"\".exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe\"}\n \"schtasks.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\Windows\\\\System32\\\\schtasks.exe\"}\n \"RegSvcs.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\RegSvcs.exe\"}","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-247","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$43","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege8\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004008.00000001.69408.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"RegSvcs.exe\" opened \"\\Device\\KsecDD\"\n \"DmLfWZhKpoh.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to map section into the virtual address space of a process","description":"$45","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-259","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to unmap view of a section from a process","description":"\".exe\" called \"NtUnmapViewOfSection\" with parameters {\"ProcessHandle\": \"4294967295\"}","origin":"API Call","mitre_attack_id":"T1055.012","relevance":1,"id":"api-261","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"DmLfWZhKpoh.exe\" - Location: [%APPDATA%\\DmLfWZhKpoh.exe]- [targetUID: 00000000-00004008]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"DmLfWZhKpoh.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"RegSvcs.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"DmLfWZhKpoh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".reloc\n .reloc with unusual entropies 0.101910425663\n 0.101910425663","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$46","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"1566804069\" milliseconds\n \".exe\" sleeping for \"00240000\" milliseconds\n \"DmLfWZhKpoh.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"25/70 Antivirus vendors marked sample as malicious (35% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\".exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"RegSvcs.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DmLfWZhKpoh.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]\n \"DmLfWZhKpoh.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\DmLfWZhKpoh.exe]- [targetUID: 00000000-00004008]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\".exe\" wrote 26112 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\DmLfWZhKpoh.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$47","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"$48","origin":"API Call","mitre_attack_id":"T1005","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access mail clients information (file access)","description":"$49","origin":"API Call","mitre_attack_id":"T1114","relevance":5,"id":"api-131","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to steal VPN information (file access)","description":"\"RegSvcs.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\NORDVPN\"\n \"RegSvcs.exe\" trying to open a file \"%LOCALAPPDATA%\\NORDVPN\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-98","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmp7DAE.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmp7DAE.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$4a","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessW\" with parameter \"\"{path}\"\" - (UID: 00000000-00004008)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"\".exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\"\n which might be an injection preparation attempt ...","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"25/70 Antivirus vendors marked sample as malicious (35% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"25/70 Antivirus vendors marked dropped file \"DmLfWZhKpoh.exe.bin\" as malicious (classified as \"UDS:Trojan.MSIL.Taskun\" with 35% detection rate)\n 25/70 Antivirus vendors marked dropped file \"DmLfWZhKpoh.exe\" as malicious (classified as \"UDS:Trojan.MSIL.Taskun\" with 35% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"25/70 Antivirus vendors marked spawned process \"DmLfWZhKpoh.exe\" (PID: 2492) as malicious (classified as \"UDS:Trojan.MSIL.Taskun\" with 35% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$4b","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Reads FTP client related registry keys","description":"\"RegSvcs.exe\" (Path: \"HKCU\\SOFTWARE\\FTPWARE\\COREFTP\\SITES\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-31","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal FTP credentials from registry","description":"\"RegSvcs.exe opens key \" (Path: \"HKCU\\SOFTWARE\\FTPWARE\\COREFTP\\SITES\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":5,"id":"registry-100","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Putty/Winscp sessions from registry","description":"\"RegSvcs.exe opens key \" (Path: \"HKCU\\SOFTWARE\\MARTIN PRIKRYL\\WINSCP 2\\SESSIONS\")","origin":"Registry Access","mitre_attack_id":"T1552.002","relevance":10,"id":"registry-74","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$4d","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"name":"Stealer/Phishing","details_count":3,"details":[{"detail":"Reads FTP client related registry keys"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":94,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"645a8621bff901e0000d65df","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"UDS:Trojan.MSIL.Taskun","submit_name":"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe","analysis_start_time":"2023-05-09T17:42:58+00:00","indicators_count":{"informative":124,"suspicious":41,"malicious":18},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}],"processes":[{"pid":4008,"ppid":0,"name":"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe","command_line":"","sha256":"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715","normalized_path":"C:\\ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715.exe","uid":"00000000-00004008","icon":"$4e"},{"pid":384,"ppid":4008,"name":"schtasks.exe","command_line":"/Create /TN \"Updates\\DmLfWZhKpoh\" /XML \"%TEMP%\\tmp7DAE.tmp\"","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00000000-00004008","uid":"00000000-00000384"},{"pid":1740,"ppid":4008,"name":"RegSvcs.exe","command_line":"\"{path}\"","sha256":"c09191a1a46b7bfa82e381c5a0cc5fae83787d63f550a8bd6beaf33cc5c0c344","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe","parent_uid":"00000000-00004008","uid":"00000000-00001740"},{"pid":2492,"ppid":0,"name":"DmLfWZhKpoh.exe","command_line":"","sha256":"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715","normalized_path":"%APPDATA%\\DmLfWZhKpoh.exe","uid":"00000000-00002492","icon":"$4f"}],"all_imported_dlls":["setupapi.dll","KernelBase.dll","propsys.dll","lpk.dll","ole32.dll","mscoreei.dll","vcruntime140_clr0400.dll","System.Windows.Forms.ni.dll","System.Configuration.ni.dll","userenv.dll","System.Management.ni.dll","System.Security.ni.dll","ntdll.dll","kernel32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","sechost.dll","psapi.dll","devobj.dll","wbemcomn.dll","System.Data.dll","ntmarta.dll","usp10.dll","wininet.dll","fastprox.dll","fltLib.dll","crypt32.dll","apphelp.dll","oleaut32.dll","imm32.dll","shell32.dll","bcrypt.dll","cfgmgr32.dll","Wldap32.dll","shlwapi.dll","System.Xml.ni.dll","clbcatq.dll","System.Drawing.ni.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","vaultcli.dll","System.Web.Extensions.dll","ucrtbase_clr0400.dll","System.Data.ni.dll","normaliz.dll","secur32.dll","msvcrt.dll","GdiPlus.dll","taskschd.dll","wbemsvc.dll","version.dll","clr.dll","System.ni.dll","ktmw32.dll","wmiutils.dll","api-ms-win-core-synch-l1-2-0.dll","msasn1.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","urlmon.dll","cryptbase.dll","profapi.dll","rsaenh.dll","advapi32.dll","msctf.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","iertutil.dll","WMINet_Utils.dll","nsi.dll","System.Core.ni.dll","clrjit.dll","comctl32.dll","user32.dll","System.Runtime.Remoting.ni.dll","mscorrc.dll","sspicli.dll","wbemprox.dll","ntdsapi.dll","gdi32.dll","ieframe.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","rpcrt4.dll","System.Windows.Forms.dll","Microsoft.VisualBasic.ni.dll","api-ms-win-core-xstate-l2-1-0.dll","VxSSL32.dll","ws2_32.dll","nlssorting.dll","cryptsp.dll","mscorlib.ni.dll","uxtheme.dll","RpcRtRemote.dll","WindowsCodecs.dll","mscoree.dll","rpcss.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"DmLfWZhKpoh.exe","sha256":"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"name":"DmLfWZhKpoh.exe.bin","sha256":"ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"name":"tmp7DAE.tmp","sha256":"72c18318a8d8841e0277c6386eb4a8a713181e95e5c3d07e142a3255e0edb96e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net data provider for sqlserver","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"name":"LHxaAbnaLJqHrzoSp","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"name":"Global\\.net data provider for sqlserver","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\LHxaAbnaLJqHrzoSp","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"645a8621bff901e0000d65df"}]}]}},"report_ids":{"sandbox_job_ids":["645a8621bff901e0000d65df"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample ad3b7fbafb3b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ad3b7fbafb3b…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/28 AV engines flagged this file. 13 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample ad3b7fbafb3b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ad3b7fbafb3b…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/28 AV engines flagged this file. 13 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ad3b7fbafb3b8778f1ba4cc5a02f9e5976bc93eef018b83dc99edd59a2360715"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample ad3b7fbafb3b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ad3b7fbafb3b…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/28 AV engines flagged this file. 13 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L50","11",{}]]