24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] a1:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Yogi.Generic Sample ad755d2dfeaa… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ad755d2dfeaa…. Malware family: Yogi.Generic. Threat score 100/100. 11/27 AV engines flagged this file. 9 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","keywords":["Malicious","Yogi.Generic","malware analysis","sandbox report","threat intelligence","ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab"],"about":{"@type":"SoftwareApplication","name":"MSOCF.dll","applicationCategory":["pedll","executable"],"identifier":"ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Yogi.Generic","antivirusDetections":{"malicious":11,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T2003,Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFile2"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount64"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleWindow"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "sample.bin")26:T66c,Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00000008.00000000.246917.044C0000.00000040.mdmp, 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00000400.00000000.244980.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.043E0000.00000040.mdmp, 00000000-00000400.00000001.246589.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001312.00000001.246586.043E0000.00000040.mdmp, 00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003928.00000000.246917.04580000.00000040.mdmp, 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004044.00000000.244979.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004656.00000000.246912.04C10000.00000040.mdmp, 00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")27:T16c0,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "MSOCF.dll") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; File: "MSOCF.dll") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "MSOCF.dll") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000008.00000000.246917.044C0000.00000040.mdmp, 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00000008.00000000.246917.044C0000.00000040.mdmp, 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000008.00000000.246917.044C0000.00000040.mdmp, 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000400.00000000.244980.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.043E0000.00000040.mdmp, 00000000-00000400.00000001.246589.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00000400.00000000.244980.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.043E0000.00000040.mdmp, 00000000-00000400.00000001.246589.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000400.00000000.244980.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.043E0000.00000040.mdmp, 00000000-00000400.00000001.246589.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001312.00000001.246586.043E0000.00000040.mdmp, 00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001312.00000001.246586.043E0000.00000040.mdmp, 00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001312.00000001.246586.043E0000.00000040.mdmp, 00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003928.00000000.246917.04580000.00000040.mdmp, 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003928.00000000.246917.04580000.00000040.mdmp, 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003928.00000000.246917.04580000.00000040.mdmp, 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004044.00000000.244979.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004044.00000000.244979.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004044.00000000.244979.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004656.00000000.246912.04C10000.00000040.mdmp, 00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004656.00000000.246912.04C10000.00000040.mdmp, 00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")28:T450,Found reference to API "OpenEventLogW" (Indicator: "OpenEventLog"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "OpenEventLogW" (Indicator: "OpenEventLog"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "OpenEventLogW" (Indicator: "OpenEventLog"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "OpenEventLogW" (Indicator: "OpenEventLog"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "OpenEventLogW" (Indicator: "OpenEventLog"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "OpenEventLogW" (Indicator: "OpenEventLog"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")29:T492,Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")2a:T45c,Found reference to API "ClearEventLogW" (Indicator: "ClearEventLog"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "ClearEventLogW" (Indicator: "ClearEventLog"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "ClearEventLogW" (Indicator: "ClearEventLog"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "ClearEventLogW" (Indicator: "ClearEventLog"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "ClearEventLogW" (Indicator: "ClearEventLog"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "ClearEventLogW" (Indicator: "ClearEventLog"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")2b:T67f,Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "MSOCF.dll") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; File: "MSOCF.dll") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; File: "MSOCF.dll") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; File: "MSOCF.dll") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004044.00000000.244979.00EB9000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")2c:Tb67,Found reference to API "RegSetKeySecurity" (Indicator: "RegSetKeySecurity"; File: "MSOCF.dll") Found reference to API "RegSetKeyValueW" (Indicator: "RegSetKeyValue"; File: "MSOCF.dll") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00000008.00000000.246917.044C0000.00000040.mdmp, 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00000400.00000000.244980.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.043E0000.00000040.mdmp, 00000000-00000400.00000001.246589.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00001312.00000001.246586.043E0000.00000040.mdmp, 00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00003928.00000000.246917.04580000.00000040.mdmp, 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00004044.00000000.244979.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00004656.00000000.246912.04C10000.00000040.mdmp, 00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")2d:T52d,Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; File: "MSOCF.dll") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; File: "MSOCF.dll") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")2e:T499,Found reference to API "OpenServiceW" (Indicator: "OpenService"; File: "MSOCF.dll") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")2f:T4cc,Found reference to API "NdrClientCall4" (Indicator: "NdrClientCall"; File: "MSOCF.dll") Found reference to API "RpcStringFreeW" (Indicator: "RpcStringFree"; File: "MSOCF.dll") Found reference to API "RpcBindingFromStringBindingW" (Indicator: "RpcBindingFromStringBinding"; File: "MSOCF.dll") Found reference to API "RpcBindingFree" (Indicator: "RpcBindingFree"; File: "MSOCF.dll") Found reference to API "RpcStringBindingComposeW" (Indicator: "RpcStringBindingCompose"; File: "MSOCF.dll") Found reference to API "RpcServerListen" (Indicator: "RpcServerListen"; File: "MSOCF.dll") Found reference to API "RpcServerRegisterIf2" (Indicator: "RpcServerRegisterIf"; File: "MSOCF.dll") Found reference to API "NdrServerCall2" (Indicator: "NdrServerCall2"; File: "MSOCF.dll") Found reference to API "NdrServerCall2" (Indicator: "NdrServerCall"; File: "MSOCF.dll") Found reference to API "NdrClientCall2" (Indicator: "NdrClientCall2"; File: "MSOCF.dll") Found reference to API "NdrClientCall2" (Indicator: "NdrClientCall"; File: "MSOCF.dll") Found reference to API "RpcServerUseProtseqEpW" (Indicator: "RpcServerUse"; File: "MSOCF.dll") Found reference to API "RpcStringFreeA" (Indicator: "RpcStringFree"; File: "MSOCF.dll")30:T8fa,Found PE header "MZ" - Source: "00000000-00000008.00000000.246917.044C0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00000400.00000000.244980.04470000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00000400.00000001.246589.043E0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00000400.00000001.246589.04470000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001312.00000001.246586.043E0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003928.00000000.246917.04580000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004044.00000000.244979.04F10000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004044.00000001.246587.04F10000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004656.00000000.246912.04C10000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004656.00000000.246912.05470000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005276.00000000.246914.04710000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005276.00000000.246914.050E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005276.00000000.246914.05220000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00007008.00000001.246585.04370000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00007008.00000001.246585.04BB0000.00000040.mdmp")31:T80b,Found string - \\.\STProcessMonitorDriver; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string - \.\STProcessMonitorDriver; Source: "00000000-00000400.00000001.246589.00920000.00000004.mdmp") Found string - \\.\STProcessMonitorDriver; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string - \\.\STProcessMonitorDriver; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found string - \\.\STProcessMonitorDriver; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found string - \.\DISPLAY1; Source: "00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found string - \\.\DISPLAY1; Source: "00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found string - \\.\DISPLAY1 1280*800; Source: "00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found string - \\.\DISPLAY2; Source: "00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found string - \\.\DISPLAY3; Source: "00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found string - \\.\DISPLAY4; Source: "00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found string - \\.\DISPLAY5; Source: "00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found string - \\.\DISPLAY6; Source: "00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found string - \\.\DISPLAY7; Source: "00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found string - \\.\DISPLAY8; Source: "00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found string - \\.\STProcessMonitorDriver; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found string - \\.\STProcessMonitorDriver; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")32:T9ec,"rundll32.exe" queried SystemProcessInformation at 00000000-00007008-00000C15-2826901419 [PID: 7008] "rundll32.exe" queried SystemProcessInformation at 00000000-00007008-00000C15-2826910359 [PID: 7008] "rundll32.exe" queried SystemProcessInformation at 00000000-00007008-00000C15-2827329381 [PID: 7008] "rundll32.exe" queried SystemProcessInformation at 00000000-00007008-00000C15-2827337181 [PID: 7008] "rundll32.exe" queried SystemProcessInformation at 00000000-00007008-00000C15-2827650162 [PID: 7008] "rundll32.exe" queried SystemProcessInformation at 00000000-00007008-00000C15-2827657546 [PID: 7008] "rundll32.exe" queried SystemProcessInformation at 00000000-00007008-00000C15-2855408517 [PID: 7008] "rundll32.exe" queried SystemProcessInformation at 00000000-00007008-00000C15-2855416045 [PID: 7008] "rundll32.exe" queried SystemProcessInformation at 00000000-00004044-00000C15-2826898399 [PID: 4044] "rundll32.exe" queried SystemProcessInformation at 00000000-00004044-00000C15-2826907507 [PID: 4044] "rundll32.exe" queried SystemProcessInformation at 00000000-00004044-00000C15-2827165777 [PID: 4044] "rundll32.exe" queried SystemProcessInformation at 00000000-00004044-00000C15-2827172978 [PID: 4044] "rundll32.exe" queried SystemProcessInformation at 00000000-00004044-00000C15-2827616713 [PID: 4044] "rundll32.exe" queried SystemProcessInformation at 00000000-00004044-00000C15-2827635174 [PID: 4044] "rundll32.exe" queried SystemProcessInformation at 00000000-00004044-00000C15-2854957224 [PID: 4044] "rundll32.exe" queried SystemProcessInformation at 00000000-00004044-00000C15-2854968839 [PID: 4044] "rundll32.exe" queried SystemProcessInformation at 00000000-00000400-00000C15-2826998886 [PID: 400] "rundll32.exe" queried SystemProcessInformation at 00000000-00000400-00000C15-2827007721 [PID: 400] "rundll32.exe" queried SystemProcessInformation at 00000000-00000400-00000C15-2827392031 [PID: 400] "rundll32.exe" queried SystemProcessInformation at 00000000-00000400-00000C15-2827400382 [PID: 400] "rundll32.exe" queried SystemProcessInformation at 00000000-00000400-00000C15-2827747013 [PID: 400] "rundll32.exe" queried SystemProcessInformation at 00000000-00000400-00000C15-2827790567 [PID: 400] "rundll32.exe" queried SystemProcessInformation at 00000000-00000400-00000C15-2854460819 [PID: 400] "rundll32.exe" queried SystemProcessInformation at 00000000-00000400-00000C15-2854470961 [PID: 400] "rundll32.exe" queried SystemProcessInformation at 00000000-00001312-00000C15-2826947472 [PID: 1312]33:Tbde,Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "MSOCF.dll") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "MSOCF.dll") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "MSOCF.dll") Found api reference "CertGetCertificateContextProperty" (Indicator: "CertGetCertificateContextProperty"; File: "MSOCF.dll") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "MSOCF.dll") Found api reference "CertGetNameStringA" (Indicator: "CertGetNameStringA"; File: "MSOCF.dll") Found api reference "CertStrToNameW" (Indicator: "CertStrToNameW"; File: "MSOCF.dll") Found api reference "CertCreateCertificateChainEngine" (Indicator: "CertCreateCertificateChainEngine"; File: "MSOCF.dll") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "MSOCF.dll") Found api reference "CertSaveStore" (Indicator: "CertSaveStore"; File: "MSOCF.dll") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "MSOCF.dll") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "MSOCF.dll") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChain"; File: "MSOCF.dll") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChainEngine"; File: "MSOCF.dll") Found api reference "CertCreateSelfSignCertificate" (Indicator: "CertCreateSelfSignCertificate"; File: "MSOCF.dll") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "MSOCF.dll") Found api reference "CertAddStoreToCollection" (Indicator: "CertAddStoreToCollection"; File: "MSOCF.dll") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "MSOCF.dll") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "MSOCF.dll") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "MSOCF.dll") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "MSOCF.dll") Found api reference "BCryptFinalizeKeyPair" (Indicator: "BCryptFinalizeKeyPair"; File: "MSOCF.dll") Found api reference "BCryptGenerateKeyPair" (Indicator: "BCryptGenerateKeyPair"; File: "MSOCF.dll") Found api reference "BCryptVerifySignature" (Indicator: "BCryptVerifySignature"; File: "MSOCF.dll") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "MSOCF.dll") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; File: "MSOCF.dll") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "MSOCF.dll") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "MSOCF.dll") Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; File: "MSOCF.dll") Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; File: "MSOCF.dll")34:Tda9,file/memory contains long string with (Indicator: "BCryptOpenAlgorithmProvider"; File: "AppLockerCSP.dll") file/memory contains long string with (Indicator: "BCryptOpenAlgorithmProvider"; File: "AppxAllUserStore.dll") file/memory contains long string with (Indicator: "BCryptOpenAlgorithmProvider"; File: "AppxSip.dll") file/memory contains long string with (Indicator: "BCryptOpenAlgorithmProvider"; File: "aadauthhelper.dll") file/memory contains long string with (Indicator: "BCryptOpenAlgorithmProvider"; File: "bcrypt.dll") file/memory contains long string with (Indicator: "BCryptOpenAlgorithmProvider"; File: "appidapi.dll") file/memory contains long string with (Indicator: "BCryptOpenAlgorithmProvider"; File: "BthTelemetry.dll") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007008-00000C2C-2854094063") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00007008-00000C2C-2854094122") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "MSOCF.dll") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "MSOCF.dll") Found reference to API "BCryptGenerateKeyPair" (Indicator: "BCryptGenerateKeyPair"; File: "MSOCF.dll") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "MSOCF.dll") Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; File: "MSOCF.dll") Found reference to API "BCryptImportKeyPair" (Indicator: "BCryptImportKey"; File: "MSOCF.dll") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "MSOCF.dll") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp")35:Taba,Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "MSOCF.dll") Found reference to API "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "MSOCF.dll") Found reference to API "CertGetNameStringA" (Indicator: "CertGetNameString"; File: "MSOCF.dll") Found reference to API "CertCreateSelfSignCertificate" (Indicator: "CertCreateSelfSignCertificate"; File: "MSOCF.dll") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "MSOCF.dll") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "MSOCF.dll") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "MSOCF.dll") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "MSOCF.dll") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "MSOCF.dll") Found reference to API "BCryptVerifySignature" (Indicator: "CryptVerifySignature"; File: "MSOCF.dll") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; File: "MSOCF.dll") Found reference to API "BCryptEncrypt" (Indicator: "CryptEncrypt"; File: "MSOCF.dll") Found reference to API "BCryptImportKey" (Indicator: "CryptImportKey"; File: "MSOCF.dll") Found reference to API "BCryptDeriveKey" (Indicator: "CryptDeriveKey"; File: "MSOCF.dll") Found reference to API "BCryptImportKeyPair" (Indicator: "CryptImportKey"; File: "MSOCF.dll") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "MSOCF.dll") Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "MSOCF.dll") Found reference to API "BCryptSignHash" (Indicator: "CryptSignHash"; File: "MSOCF.dll") Found reference to API "BCryptDestroySecret" (Indicator: "CryptDestroySecret"; File: "MSOCF.dll") Found reference to API "BCryptExportKey" (Indicator: "CryptExportKey"; File: "MSOCF.dll") Found reference to API "NCryptSetProperty" (Indicator: "NCryptSetProperty"; File: "MSOCF.dll") Found reference to API "NCryptFreeObject" (Indicator: "NCryptFreeObject"; File: "MSOCF.dll") Found reference to API "NCryptExportKey" (Indicator: "CryptExportKey"; File: "MSOCF.dll") Found reference to API "CryptExportPublicKeyInfo" (Indicator: "CryptExportPublicKeyInfo"; File: "MSOCF.dll") Found reference to API "CryptHashCertificate" (Indicator: "CryptHashCertificate"; File: "MSOCF.dll") Found reference to API "CryptProtectData" (Indicator: "CryptProtectData"; File: "MSOCF.dll") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "MSOCF.dll") Found reference to API "CryptEncodeObject" (Indicator: "CryptEncodeObject"; File: "MSOCF.dll")36:T4a3,Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00000008.00000000.246917.00690000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00000400.00000000.244980.00920000.00000004.mdmp, 00000000-00000400.00000001.246589.00920000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001312.00000000.244981.00920000.00000004.mdmp, 00000000-00001312.00000001.246586.00920000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003928.00000000.246917.00B00000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004044.00000000.244979.00F00000.00000004.mdmp, 00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00004656.00000000.246912.03110000.00000004.mdmp") Found string ":\WINDOWS\System32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp")37:T526,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to access crypto-related API (String) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Detected Suricata alert – Encrypted channel Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Imports crypto-related APIs Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm38:T17ef4,Found XOR loop in file "BingMaps.dll" at offset 71608; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 432123; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 1544682; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 1762826; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 1762875; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 3693378; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 4835032; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 4835060; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 4835088; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 4835130; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 4835158; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 4835172; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 4837084; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 4837132; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 4846280; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 4849089; code bytes = 30d0 Found XOR loop in file "BingMaps.dll" at offset 1941871; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 2130176; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 2419944; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 2446049; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 2446193; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 2446257; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 2446316; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 2484805; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 2486542; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 2488344; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 2488896; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 2496386; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 3619883; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 4396200; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 4562094; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 4563154; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 4563158; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 4563166; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 4617328; code bytes = 33c1 Found XOR loop in file "BingMaps.dll" at offset 7668; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 54156; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 85560; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 250680; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 271304; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 335064; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 338840; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 406333; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 423299; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 423304; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 423309; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 423314; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 423319; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 424243; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 436168; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 601391; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 826415; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 826471; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 843659; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1107139; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1140127; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1515192; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1538530; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1557305; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1563013; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1568099; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1571139; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1577931; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1579977; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1586148; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1594023; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1594904; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1598793; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1610326; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 1981916; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 2161929; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 2506226; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 3035905; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 3102875; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 3145812; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 3146012; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 3164802; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 3164908; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 3164953; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 3165051; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 3324968; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 4055579; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 4217752; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 4304563; code bytes = 8030 Found XOR loop in file "BingMaps.dll" at offset 4990052; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 425847; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 505105; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 509737; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 560841; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 560845; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 562129; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 563413; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 564697; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 568549; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 569833; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 571117; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 572401; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 573681; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 615077; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 633557; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3023001; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3023545; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3239281; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3239881; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3246313; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3246317; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3246481; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3246645; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3246809; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3247301; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3247465; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3247629; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3247793; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3247953; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3253125; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 3255477; code bytes = 30d0 Found XOR loop in file "aclui.dll" at offset 53670; code bytes = 33c1 Found XOR loop in file "aclui.dll" at offset 98538; code bytes = 33c1 Found XOR loop in file "aclui.dll" at offset 257761; code bytes = 33c1 Found XOR loop in file "aclui.dll" at offset 3186719; code bytes = 33c1 Found XOR loop in file "aclui.dll" at offset 3206992; code bytes = 33c1 Found XOR loop in file "aclui.dll" at offset 3229988; code bytes = 33c1 Found XOR loop in file "aclui.dll" at offset 3229996; code bytes = 33c1 Found XOR loop in file "aclui.dll" at offset 111108; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 418375; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 527178; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 565586; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 705770; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 710114; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 1311798; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 2909063; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 3849066; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 3871498; code bytes = 8030 Found XOR loop in file "aclui.dll" at offset 3947350; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1045929; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1276173; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1289113; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1291612; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1385011; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1506571; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1701331; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1712264; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1881517; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 2040999; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 2182945; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 2228277; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 3938407; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 3951347; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 3953846; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4005453; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4127013; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4321520; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4332453; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4501706; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4660939; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4802885; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 4848217; code bytes = 30d0 Found XOR loop in file "AuthFWSnapin.dll" at offset 1146837; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 1151615; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 1763189; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 1879283; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 2136043; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 2163121; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 2171320; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 2211305; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 2258929; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 2259973; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 3475840; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 3491480; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 3809071; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 3813849; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4383378; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4499472; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4755983; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4783061; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4791260; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4831245; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4878869; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 4879913; code bytes = 33c1 Found XOR loop in file "AuthFWSnapin.dll" at offset 313063; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 320223; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 336623; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 336831; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 416856; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1080039; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1129197; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1139263; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1160522; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1497234; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1521391; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1542352; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1543081; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1554284; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1595779; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1596799; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1598327; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1599347; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1648459; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1650367; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1760910; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1816138; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1818576; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1835168; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1835577; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1840597; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 1843347; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 2079377; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 2152341; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 2177575; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 2597794; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 3791431; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 3801497; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 3822756; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4117676; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4141833; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4162794; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4163523; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4174726; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4216221; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4217241; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4218769; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4219789; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4268901; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4270809; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4381099; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4436327; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4438765; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4455357; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4455766; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4460786; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4463536; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4699317; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4772281; code bytes = 8030 Found XOR loop in file "AuthFWSnapin.dll" at offset 4797515; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 210256; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 318155; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 1296674; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 1714386; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 1835254; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 2147516; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 2569260; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 3180141; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 3212048; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 3429128; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 3667309; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 3793997; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 3795461; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 3803445; code bytes = 30d0 Found XOR loop in file "accessibilitycpl.dll" at offset 67945; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 67969; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 68033; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 68167; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 68481; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 68545; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 96307; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 96331; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 96395; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 96529; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 96843; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 96907; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 159590; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 258357; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 1047425; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 1087209; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 1132142; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 1294911; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 1500387; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 1813334; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 2569007; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 3426219; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 3442488; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 3676702; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 3795255; code bytes = 33c1 Found XOR loop in file "accessibilitycpl.dll" at offset 187019; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 187663; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 189711; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 267109; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 287942; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 289662; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 290349; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 304341; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 819160; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 854620; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1046180; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1064831; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1287614; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1287761; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1295701; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1728921; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1938454; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 1940711; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 2115417; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 2274177; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 2347320; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 2382780; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 2585293; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3180228; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3211499; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3213199; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3223522; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3243624; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3435100; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3659920; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3793958; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3803434; code bytes = 8030 Found XOR loop in file "accessibilitycpl.dll" at offset 3803690; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 31180; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 33696; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 86002; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 87257; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 1812087; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 2375253; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3005535; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3007591; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3009647; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3011703; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3013759; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3015815; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3017871; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3019927; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3021983; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3024039; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3026095; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3027995; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3029853; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3031793; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3033835; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3044575; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3050827; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3052933; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3053349; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3053797; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3071945; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3086609; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3088535; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3089409; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3101175; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3120541; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3121503; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3122895; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3123955; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3137539; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3138681; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3143671; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3144271; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3149649; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3151283; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3156311; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3158721; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3160469; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3166887; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3167481; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3168075; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3180063; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 3181203; code bytes = 30d0 Found XOR loop in file "cdp.dll" at offset 1326061; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 1382312; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 1382456; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 1382520; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 1382579; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 1633403; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 2144304; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 2144415; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 2154443; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 2155595; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 2155599; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 2155607; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 2299820; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 3040143; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 3041101; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 3049753; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 3066857; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 3069585; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 3070261; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 3076863; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 3079731; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 3080809; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 3103967; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 3128891; code bytes = 33c1 Found XOR loop in file "cdp.dll" at offset 6416; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 19188; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 21848; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 73367; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 80212; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 81922; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 95167; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 312476; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 446514; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 1838905; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 2630780; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 2748068; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3005496; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3007552; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3009608; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3011664; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3013720; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3015776; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3017832; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3019888; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3021944; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3024000; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3026056; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3027964; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3029816; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3031756; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3033796; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3040820; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3045712; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3048126; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3055540; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3056806; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3062438; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3066820; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3081612; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3096310; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3099000; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3116942; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3127700; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3129310; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3135126; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3139274; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3140786; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3144810; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3145432; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3147792; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3149638; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3151946; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3153146; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3156928; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3157446; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3158710; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3161580; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3162730; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3163430; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3164000; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3165194; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3165828; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3168668; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3170908; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3175046; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3176132; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3176752; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3178684; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3180196; code bytes = 8030 Found XOR loop in file "cdp.dll" at offset 3181164; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2344425; code bytes = 30d0 Found XOR loop in file "AcGenral.dll" at offset 2351799; code bytes = 30d0 Found XOR loop in file "AcGenral.dll" at offset 2365165; code bytes = 30d0 Found XOR loop in file "AcGenral.dll" at offset 2369527; code bytes = 30d0 Found XOR loop in file "AcGenral.dll" at offset 2389285; code bytes = 30d0 Found XOR loop in file "AcGenral.dll" at offset 2392401; code bytes = 30d0 Found XOR loop in file "AcGenral.dll" at offset 195894; code bytes = 33c1 Found XOR loop in file "AcGenral.dll" at offset 2355457; code bytes = 33c1 Found XOR loop in file "AcGenral.dll" at offset 2356351; code bytes = 33c1 Found XOR loop in file "AcGenral.dll" at offset 2368001; code bytes = 33c1 Found XOR loop in file "AcGenral.dll" at offset 2379863; code bytes = 33c1 Found XOR loop in file "AcGenral.dll" at offset 6321; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 25620; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 232491; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 276087; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 277516; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 280979; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 352024; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 400886; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 519101; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 644962; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 709331; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 709587; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 709859; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 710115; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2331744; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2332666; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2344422; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2353466; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2358882; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2361182; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2364496; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2383764; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2390418; code bytes = 8030 Found XOR loop in file "AcGenral.dll" at offset 2392382; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 16248; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 59523; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1769539; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1779053; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1782825; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1783853; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1784417; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1785529; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1933423; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1935479; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1937535; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1939591; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1941631; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1943687; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1945615; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1947671; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1948973; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1950553; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1951497; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1963103; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1965665; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1969159; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1981583; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2001687; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2003541; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2015651; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2016245; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2016843; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2019775; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2021071; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2021589; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2022751; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2024587; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2026379; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2032441; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2037225; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 2037809; code bytes = 30d0 Found XOR loop in file "cmiv2.dll" at offset 1140242; code bytes = 33c1 Found XOR loop in file "cmiv2.dll" at offset 1140573; code bytes = 33c1 Found XOR loop in file "cmiv2.dll" at offset 1382822; code bytes = 33c1 Found XOR loop in file "cmiv2.dll" at offset 1951943; code bytes = 33c1 Found XOR loop in file "cmiv2.dll" at offset 1987371; code bytes = 33c1 Found XOR loop in file "cmiv2.dll" at offset 1992505; code bytes = 33c1 Found XOR loop in file "cmiv2.dll" at offset 1998463; code bytes = 33c1 Found XOR loop in file "cmiv2.dll" at offset 39823; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 389080; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1466951; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1714419; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1724959; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1928247; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1933384; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1935440; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1937496; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1939552; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1941592; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1943648; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1945576; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1947632; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1949532; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1950534; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1951458; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1962454; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1972456; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1973590; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 1999702; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2002214; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2011492; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2012116; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2014412; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2016238; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2025792; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2027468; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2031732; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2033032; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2035026; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2036128; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2038288; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2038878; code bytes = 8030 Found XOR loop in file "cmiv2.dll" at offset 2048388; code bytes = 8030 Found XOR loop in file "batmeter.dll" at offset 1661471; code bytes = 30d0 Found XOR loop in file "batmeter.dll" at offset 6918; code bytes = 33c1 Found XOR loop in file "batmeter.dll" at offset 29715; code bytes = 8030 Found XOR loop in file "batmeter.dll" at offset 117253; code bytes = 8030 Found XOR loop in file "batmeter.dll" at offset 121221; code bytes = 8030 Found XOR loop in file "batmeter.dll" at offset 1663280; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 934371; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1473647; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1475703; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1477317; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1479211; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1502801; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1504297; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1504565; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1520729; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1537479; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1546003; code bytes = 30d0 Found XOR loop in file "ActiveSyncProvider.dll" at offset 245478; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 356201; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 694873; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 694886; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 939691; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 939840; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1109842; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1177716; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426027; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426046; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426065; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426084; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426103; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426122; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426141; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426163; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1426195; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1484347; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1492585; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1494557; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1505613; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1525849; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1528371; code bytes = 33c1 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1341505; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1432851; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1435507; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1473608; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1475664; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1477308; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1479172; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1482504; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1487960; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1495030; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1496162; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1502598; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1506592; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1507254; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1512454; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1522338; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1524966; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1528552; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1530564; code bytes = 8030 Found XOR loop in file "ActiveSyncProvider.dll" at offset 1546202; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1405021; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1406083; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1407759; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1409815; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1411871; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1413773; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1415607; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1417663; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1419719; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1420731; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1426293; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1429837; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1436695; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1447251; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1451481; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1459231; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1474315; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1477579; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1479557; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1479727; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1480253; code bytes = 30d0 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 735645; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 814544; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1026180; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1120326; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1120459; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1432653; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1441665; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1447681; code bytes = 33c1 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 10564; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 22444; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 22620; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 98519; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 99054; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 280876; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 293226; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 599548; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 902908; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1404992; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1406064; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1407720; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1409776; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1411832; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1415568; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1417624; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1419680; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1422320; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1427202; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1429818; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1431568; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1437844; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1444516; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1450296; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1455736; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1456672; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1465960; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1466436; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1471956; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1476446; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1477574; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1479442; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1483528; code bytes = 8030 Found XOR loop in file "AppVEntSubsystems32.dll" at offset 1490308; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 212735; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1239151; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1242451; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1243987; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1250665; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1255071; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1258609; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1258997; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1263479; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1266481; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1270897; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 1272907; code bytes = 30d0 Found XOR loop in file "AppxPackaging.dll" at offset 282038; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282057; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282076; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282095; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282114; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282133; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282152; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282174; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 282206; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 313156; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 315139; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 315724; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 336780; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665261; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665369; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665384; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665469; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665484; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665500; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665590; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 665605; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 1266531; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 1268635; code bytes = 33c1 Found XOR loop in file "AppxPackaging.dll" at offset 114503; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 697363; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 1239112; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 1242412; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 1243948; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 1259184; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 1272868; code bytes = 8030 Found XOR loop in file "AppxPackaging.dll" at offset 1273086; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1216311; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1218363; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1222319; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1225425; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1230231; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1251721; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1253159; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1258729; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1260851; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1263283; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1264881; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1267375; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1268713; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1271927; code bytes = 30d0 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 427762; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 857190; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 899967; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1225467; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1226257; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1234951; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1241971; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1254805; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1257839; code bytes = 33c1 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1188876; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1216272; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1218324; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1229530; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1234582; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1241122; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1245162; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1245916; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1246856; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1253120; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1259816; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1263742; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1264256; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1265386; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1266298; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1266824; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1267364; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1269334; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1270008; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1270676; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1273224; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1275884; code bytes = 8030 Found XOR loop in file "AzureSettingSyncProvider.dll" at offset 1276424; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 184585; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 184895; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 188635; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 192387; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 192511; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 196107; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 196271; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 199895; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 200003; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 203575; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 203719; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 203739; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 207331; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 211067; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 211175; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 212924; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 214839; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 214911; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 214991; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 436664; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1179247; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1181167; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1183215; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1184805; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1199363; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1200783; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1211641; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1214147; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1224799; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1225167; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 1237944; code bytes = 30d0 Found XOR loop in file "AudioEng.dll" at offset 323984; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 324044; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 407323; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 440194; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 1192329; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 1194249; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 1205383; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 1207631; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 1209279; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 1221155; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 1221571; code bytes = 33c1 Found XOR loop in file "AudioEng.dll" at offset 150712; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 158332; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 165792; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 169182; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 170710; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 174422; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 177864; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 181842; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 183504; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 184322; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 184584; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 186528; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 187164; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 188110; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 189096; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 189254; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 191898; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 192958; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 195690; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 196658; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 199482; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 199486; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 200354; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 203252; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 203282; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 203286; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 204042; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 204046; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 205844; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 207090; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 207094; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 207726; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 207730; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 210910; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 210914; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 211394; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 211398; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 211402; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 214758; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 214762; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 214766; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 214770; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 214774; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 215026; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 215030; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 215034; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 215038; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 215042; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 220709; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 345961; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1085934; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1179208; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1181128; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1183184; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1188264; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1203082; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1209666; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1218818; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1225128; code bytes = 8030 Found XOR loop in file "AudioEng.dll" at offset 1238606; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 3040; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 32544; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 279104; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 912495; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 914419; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 915781; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 918687; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 920743; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 922799; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 932887; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 939897; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 945587; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 946565; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 947815; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 950793; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 964105; code bytes = 30d0 Found XOR loop in file "AudioSes.dll" at offset 249703; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 768487; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 768509; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 768567; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 768691; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 768971; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 769029; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 796046; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 796068; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 796126; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 796250; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 796530; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 796588; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 926403; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 927943; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 936273; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 938159; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 944921; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 954117; code bytes = 33c1 Found XOR loop in file "AudioSes.dll" at offset 972721; code bytes = 30040e Found XOR loop in file "AudioSes.dll" at offset 26575; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 143552; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 159169; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 230997; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 234822; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 496620; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 670588; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 745889; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 866835; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 912456; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 914380; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 915762; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 917192; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 918648; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 920704; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 922760; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 932214; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 945934; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 961028; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 961518; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 962522; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 964066; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 964476; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 974706; code bytes = 8030 Found XOR loop in file "AudioSes.dll" at offset 981490; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 15013; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 584676; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 907191; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 916443; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 918953; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 930747; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 932173; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 934273; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 935491; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 937667; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 939279; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 940149; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 941933; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 945061; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 945755; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 949853; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 951911; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 954345; code bytes = 30d0 Found XOR loop in file "aadtb.dll" at offset 76968; code bytes = 33c1 Found XOR loop in file "aadtb.dll" at offset 393369; code bytes = 33c1 Found XOR loop in file "aadtb.dll" at offset 512406; code bytes = 33c1 Found XOR loop in file "aadtb.dll" at offset 910887; code bytes = 33c1 Found XOR loop in file "aadtb.dll" at offset 918791; code bytes = 33c1 Found XOR loop in file "aadtb.dll" at offset 921071; code bytes = 33c1 Found XOR loop in file "aadtb.dll" at offset 582900; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 770996; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 771016; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 907962; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 930710; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 934236; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 935482; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 937652; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 938580; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 939264; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 940134; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 948958; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 951872; code bytes = 8030 Found XOR loop in file "aadtb.dll" at offset 953756; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 34864; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 112324; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 881769; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 883813; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 885867; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 887919; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 889965; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 892009; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 894059; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 896115; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 898075; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 919371; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 932413; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 933545; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 934677; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 936323; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 937243; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 937815; code bytes = 30d0 Found XOR loop in file "cdprt.dll" at offset 584191; code bytes = 33c1 Found XOR loop in file "cdprt.dll" at offset 682604; code bytes = 33c1 Found XOR loop in file "cdprt.dll" at offset 717643; code bytes = 33c1 Found XOR loop in file "cdprt.dll" at offset 718716; code bytes = 33c1 Found XOR loop in file "cdprt.dll" at offset 718720; code bytes = 33c1 Found XOR loop in file "cdprt.dll" at offset 718728; code bytes = 33c1 Found XOR loop in file "cdprt.dll" at offset 746586; code bytes = 33c1 Found XOR loop in file "cdprt.dll" at offset 906217; code bytes = 33c1 Found XOR loop in file "cdprt.dll" at offset 908723; code bytes = 33c1 Found XOR loop in file "cdprt.dll" at offset 926929; code bytes = 33c1 Found XOR loop in file "cdprt.dll" at offset 210150; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 552919; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 552961; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 881732; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 883774; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 885828; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 887880; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 889926; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 891972; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 894020; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 896076; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 898056; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 901786; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 903504; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 912690; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 913720; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 927964; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 930220; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 931280; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 934062; code bytes = 8030 Found XOR loop in file "cdprt.dll" at offset 937784; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 252815; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 516459; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 757563; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 831779; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 833835; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 835891; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 837947; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 840003; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 844407; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 852779; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 858167; code bytes = 30d0 Found XOR loop in file "bcastdvr.exe" at offset 756486; code bytes = 33c1 Found XOR loop in file "bcastdvr.exe" at offset 842683; code bytes = 33c1 Found XOR loop in file "bcastdvr.exe" at offset 854841; code bytes = 33c1 Found XOR loop in file "bcastdvr.exe" at offset 855543; code bytes = 33c1 Found XOR loop in file "bcastdvr.exe" at offset 873499; code bytes = 33c1 Found XOR loop in file "bcastdvr.exe" at offset 880693; code bytes = 33c1 Found XOR loop in file "bcastdvr.exe" at offset 882825; code bytes = 33c1 Found XOR loop in file "bcastdvr.exe" at offset 831740; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 833796; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 835852; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 837908; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 839964; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 843256; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 862726; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 879790; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 886026; code bytes = 8030 Found XOR loop in file "bcastdvr.exe" at offset 886124; code bytes = 8030 Found XOR loop in file "autochk.exe" at offset 3176; code bytes = 30d0 Found XOR loop in file "autochk.exe" at offset 4890; code bytes = 30d0 Found XOR loop in file "autochk.exe" at offset 52852; code bytes = 30d0 Found XOR loop in file "autochk.exe" at offset 58874; code bytes = 30d0 Found XOR loop in file "autochk.exe" at offset 852591; code bytes = 30d0 Found XOR loop in file "autochk.exe" at offset 863233; code bytes = 30d0 Found XOR loop in file "autochk.exe" at offset 117775; code bytes = 33c1 Found XOR loop in file "autochk.exe" at offset 860263; code bytes = 33c1 Found XOR loop in file "autochk.exe" at offset 861103; code bytes = 33c1 Found XOR loop in file "autochk.exe" at offset 861737; code bytes = 33c1 Found XOR loop in file "autochk.exe" at offset 576531; code bytes = 8030 Found XOR loop in file "autochk.exe" at offset 852552; code bytes = 8030 Found XOR loop in file "autoconv.exe" at offset 833647; code bytes = 30d0 Found XOR loop in file "autoconv.exe" at offset 76705; code bytes = 33c1 Found XOR loop in file "autoconv.exe" at offset 837491; code bytes = 33c1 Found XOR loop in file "autoconv.exe" at offset 846781; code bytes = 33c1 Found XOR loop in file "autoconv.exe" at offset 557587; code bytes = 8030 Found XOR loop in file "autoconv.exe" at offset 833608; code bytes = 8030 Found XOR loop in file "autoconv.exe" at offset 840226; code bytes = 8030 Found XOR loop in file "autoconv.exe" at offset 843462; code bytes = 8030 Found XOR loop in file "autoconv.exe" at offset 844622; code bytes = 8030 Found XOR loop in file "autoconv.exe" at offset 847714; code bytes = 8030 Found XOR loop in file "cdosys.dll" at offset 273012; code bytes = 30d0 Found XOR loop in file "cdosys.dll" at offset 797075; code bytes = 30d0 Found XOR loop in file "cdosys.dll" at offset 806301; code bytes = 30d0 Found XOR loop in file "cdosys.dll" at offset 812815; code bytes = 30d0 Found XOR loop in file "cdosys.dll" at offset 815571; code bytes = 30d0 Found XOR loop in file "cdosys.dll" at offset 823155; code bytes = 30d0 Found XOR loop in file "cdosys.dll" at offset 823693; code bytes = 30d0 Found XOR loop in file "cdosys.dll" at offset 824243; code bytes = 30d0 Found XOR loop in file "cdosys.dll" at offset 825987; code bytes = 30d0 Found XOR loop in file "cdosys.dll" at offset 827663; code bytes = 30d0 Found XOR loop in file "cdosys.dll" at offset 215363; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 415387; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 415392; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 415432; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 415437; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 449627; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 465973; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 466104; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 466250; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 466324; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 466487; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 466598; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 495451; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 495458; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 500303; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 500310; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 529574; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 529581; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 559675; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 559680; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 613094; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 801359; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 811829; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 816703; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 817551; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 821455; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 821883; code bytes = 33c1 Found XOR loop in file "cdosys.dll" at offset 386196; code bytes = 8030 Found XOR loop in file "cdosys.dll" at offset 386418; code bytes = 8030 Found XOR loop in file "cdosys.dll" at offset 601665; code bytes = 8030 Found XOR loop in file "cdosys.dll" at offset 628767; code bytes = 8030 Found XOR loop in file "cdosys.dll" at offset 723987; code bytes = 8030 Found XOR loop in file "cdosys.dll" at offset 793160; code bytes = 8030 Found XOR loop in file "cdosys.dll" at offset 795136; code bytes = 8030 Found XOR loop in file "cdosys.dll" at offset 797036; code bytes = 8030 Found XOR loop in file "cdosys.dll" at offset 797954; code bytes = 8030 Found XOR loop in file "cdosys.dll" at offset 816866; code bytes = 8030 Found XOR loop in file "cdosys.dll" at offset 819152; code bytes = 8030 Found XOR loop in file "cdosys.dll" at offset 819874; code bytes = 8030 Found XOR loop in file "cdosys.dll" at offset 820946; code bytes = 8030 Found XOR loop in file "adtschema.dll" at offset 1043; code bytes = 8030 Found XOR loop in file "adtschema.dll" at offset 1047; code bytes = 8030 Found XOR loop in file "adtschema.dll" at offset 807207; code bytes = 8030 Found XOR loop in file "adtschema.dll" at offset 807255; code bytes = 8030 Found XOR loop in file "adtschema.dll" at offset 816855; code bytes = 8030 Found XOR loop in file "adtschema.dll" at offset 822615; code bytes = 8030 Found XOR loop in file "autofmt.exe" at offset 812655; code bytes = 30d0 Found XOR loop in file "autofmt.exe" at offset 820465; code bytes = 30d0 Found XOR loop in file "autofmt.exe" at offset 78977; code bytes = 33c1 Found XOR loop in file "autofmt.exe" at offset 208454; code bytes = 33c1 Found XOR loop in file "autofmt.exe" at offset 815479; code bytes = 33c1 Found XOR loop in file "autofmt.exe" at offset 825049; code bytes = 33c1 Found XOR loop in file "autofmt.exe" at offset 53699; code bytes = 8030 Found XOR loop in file "autofmt.exe" at offset 54231; code bytes = 8030 Found XOR loop in file "autofmt.exe" at offset 54258; code bytes = 8030 Found XOR loop in file "autofmt.exe" at offset 153582; code bytes = 8030 Found XOR loop in file "autofmt.exe" at offset 536595; code bytes = 8030 Found XOR loop in file "autofmt.exe" at offset 812616; code bytes = 8030 Found XOR loop in file "autofmt.exe" at offset 814526; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 758383; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 760439; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 764027; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 773185; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 774995; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 778395; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 779969; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 780649; code bytes = 30d0 Found XOR loop in file "azroles.dll" at offset 396550; code bytes = 33c1 Found XOR loop in file "azroles.dll" at offset 762029; code bytes = 33c1 Found XOR loop in file "azroles.dll" at offset 771453; code bytes = 33c1 Found XOR loop in file "azroles.dll" at offset 778447; code bytes = 33c1 Found XOR loop in file "azroles.dll" at offset 7911; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 371454; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 372412; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 751859; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 751895; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 752179; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 752215; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 758344; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 760400; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 771856; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 775338; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 778392; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 778748; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 780634; code bytes = 8030 Found XOR loop in file "azroles.dll" at offset 781084; code bytes = 8030 Found XOR loop in file "BingOnlineServices.dll" at offset 2780; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 2892; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 3004; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 3116; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 7440; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 7552; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 48476; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 77894; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 117282; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 232420; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 373841; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 574508; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 717935; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 719991; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 722047; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 724515; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 728477; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 739975; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 747677; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 754371; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 755375; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 755823; code bytes = 30d0 Found XOR loop in file "BingOnlineServices.dll" at offset 171885; code bytes = 33c1 Found XOR loop in file "BingOnlineServices.dll" at offset 233644; code bytes = 33c1 Found XOR loop in file "BingOnlineServices.dll" at offset 233708; code bytes = 33c1 Found XOR loop in file "BingOnlineServices.dll" at offset 233767; code bytes = 33c1 Found XOR loop in file "BingOnlineServices.dll" at offset 233832; code bytes = 33c1 Found XOR loop in file "BingOnlineServices.dll" at offset 729855; code bytes = 33c1 Found XOR loop in file "BingOnlineServices.dll" at offset 717896; code bytes = 8030 Found XOR loop in file "BingOnlineServices.dll" at offset 719952; code bytes = 8030 Found XOR loop in file "BingOnlineServices.dll" at offset 722008; code bytes = 8030 Found XOR loop in file "BingOnlineServices.dll" at offset 725296; code bytes = 8030 Found XOR loop in file "BingOnlineServices.dll" at offset 727670; code bytes = 8030 Found XOR loop in file "BingOnlineServices.dll" at offset 739022; code bytes = 8030 Found XOR loop in file "BingOnlineServices.dll" at offset 740268; code bytes = 8030 Found XOR loop in file "BingOnlineServices.dll" at offset 744770; code bytes = 8030 Found XOR loop in file "BingOnlineServices.dll" at offset 748234; code bytes = 8030 Found XOR loop in file "BingOnlineServices.dll" at offset 755006; code bytes = 8030 Found XOR loop in file "BingOnlineServices.dll" at offset 755372; code bytes = 8030 Found XOR loop in file "BingOnlineServices.dll" at offset 756082; code bytes = 8030 Found XOR loop in file "BingOnlineServices.dll" at offset 756172; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 514998; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 661626; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 736339; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 737823; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 739279; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 751425; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 753249; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 755275; code bytes = 30d0 Found XOR loop in file "appwiz.cpl" at offset 71654; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 178823; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258173; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258217; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258226; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258310; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258339; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258348; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258434; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258458; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258470; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258620; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258647; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258712; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258739; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258804; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258831; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258905; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 258930; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 259281; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 259319; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 259388; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 259480; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 259573; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 753039; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 753581; code bytes = 33c1 Found XOR loop in file "appwiz.cpl" at offset 3816; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 3996; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 4176; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 4356; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 4536; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 4720; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 5788; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 6024; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 6632; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 6868; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 9192; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 12954; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 44214; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 150652; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 151182; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 296631; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 297111; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 365275; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 372755; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 372887; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 375171; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 375243; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 427391; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 438899; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 439604; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 529918; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 590487; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 601995; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 602700; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 737784; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 739240; code bytes = 8030 Found XOR loop in file "appwiz.cpl" at offset 755236; code bytes = 803039:T573,Found string "\SystemRoot\System32\drivers\vmbus.sys" (Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\vmbkmcl.sys" (Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\vmci.sys" (Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\vmstorfl.sys" (Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\vmbkmclr.sys" (Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\vmmouse.sys" (Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\vm3dmp_loader.sys" (Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\vm3dmp.sys" (Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\vmgencounter.sys" (Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp") Found string "\SystemRoot\System32\drivers\vmusbmouse.sys" (Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp") Found string "\SystemRoot\system32\DRIVERS\vmmemctl.sys" (Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp")3a:T9dc,Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "MSOCF.dll") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; File: "MSOCF.dll") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")3b:T660,file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "AUDIOKSE.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "ActionCenter.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "audiodev.dll") file/memory contains long string with (Indicator: "ZwQuerySystemInformation"; File: "aepic.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "AppxAllUserStore.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "AppManagementConfiguration.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "BitLockerCsp.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "bcd.dll") file/memory contains long string with (Indicator: "ZwQuerySystemInformation"; File: "acppage.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "appidapi.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "ByteCodeGenerator.exe") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "BamSettingsClient.dll") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "MSOCF.dll") Found reference to API "ZwQuerySystemInformation" (Indicator: "ZwQuerySystemInformation"; File: "MSOCF.dll") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004044.00000000.244979.00EB9000.00000002.mdmp")3c:T518,file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "AUDIOKSE.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "ActionCenter.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "audiodev.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "AppxAllUserStore.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "AppManagementConfiguration.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "BitLockerCsp.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "bcd.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "appidapi.dll") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "ByteCodeGenerator.exe") file/memory contains long string with (Indicator: "NtQuerySystemInformation"; File: "BamSettingsClient.dll") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "MSOCF.dll") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004044.00000000.244979.00EB9000.00000002.mdmp")3d:T5e2,Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")3e:T4a2,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "MSOCF.dll") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")3f:T8d3,file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "AdmTmpl.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "catsrvut.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "authfwcfg.dll") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "aepic.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "AppxAllUserStore.dll") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "authz.dll") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "bitsadmin.exe") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "AuthBroker.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "appmgmts.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "advpack.dll") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "btpanui.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "BitLockerCsp.dll") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "bcd.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "bootcfg.exe") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "AtBroker.exe") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "admwprox.dll") file/memory contains long string with (Indicator: "CheckTokenMembership"; File: "ARP.EXE") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "MSOCF.dll") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "MSOCF.dll") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "MSOCF.dll") Found reference to API "CheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; File: "MSOCF.dll") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "MSOCF.dll") Found reference to API "RtlFreeSid" (Indicator: "FreeSid"; File: "MSOCF.dll")40:T1336,Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "MSOCF.dll") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; File: "MSOCF.dll") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")41:T4a2,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "MSOCF.dll") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")42:T96b,file/memory contains long string with (Indicator: "postmessage"; File: "batmeter.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "AdmTmpl.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "azroleui.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "ActionCenter.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "audiodev.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "bthprops.cpl") file/memory contains long string with (Indicator: "sendmessage"; File: "cabview.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "advpack.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "avifil32.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "adrclient.dll") file/memory contains long string with (Indicator: "postmessage"; File: "AuthBrokerUI.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "atl.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "avicap32.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "acppage.dll") file/memory contains long string with (Indicator: "postmessage"; File: "AuthExt.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "BWContextHandler.dll") file/memory contains long string with (Indicator: "postmessage"; File: "atmlib.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "Apphlpdm.dll") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00007008-00000C2C-2853833985") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "MSOCF.dll") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "MSOCF.dll") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "MSOCF.dll") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp")43:T2c6e,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007008) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007008) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004044) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004044) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000250000009e294877a8f4f4000000000038000000340000000000f00080e08d050000000000000000000000000000000000000000d007df004000000000000000050000000000df0000000000b0f50000000000000000000000005c72feffffff05000000000000000000000000000000d801df0030e08d05 (UID: 00000000-00004044) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000400) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000400) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001312) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001312) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004656) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004656) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005276) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005276) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003928) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003928) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a0000009e294877c8eab2000000000038000000340000000000b00038e007050000000000000000000000000000000000000000d007900040000000000000006a0000000000900000000000a8d20000000000000000000000005c72feffffff1a000000000000000000000000000000d8019000e8df0705 (UID: 00000000-00003928) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000008) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000008)44:T4e9,Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: cdp.dll] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: AcGenral.dll] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: cmiv2.dll] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: AppVEntSubsystems32.dll] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: aadtb.dll] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: cdprt.dll] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: bcastdvr.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: autochk.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: autoconv.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: autofmt.exe] Observed import api "OpenProcessToken" which can be "used to retrieve process information" [Source: azroles.dll]45:T4c2,Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetTimeZoneInformation" (Indicator: "GetTimeZoneInformation"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")46:Tea8,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "MSOCF.dll") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "MSOCF.dll") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "MSOCF.dll") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; File: "MSOCF.dll") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "MSOCF.dll") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")47:T4bc,Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; File: "MSOCF.dll") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")48:T835,"rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\40078385-F676-4C61-9A9C-F9028599D6D3_IS1"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX"; Key: "DISPLAYNAME") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA")49:Ta6e,Found registry modification API: "RegLoadMUIStringW" in file "MSOCF.dll" Found registry modification API: "RegCreateKeyExW" in file "MSOCF.dll" Found registry modification API: "RegLoadKeyW" in file "MSOCF.dll" Found registry modification API: "RegCreateKeyW" in "00000000-00000008.00000000.246917.044C0000.00000040.mdmp, 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp" Found registry modification API: "RegCreateKeyW" in "00000000-00000400.00000000.244980.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.043E0000.00000040.mdmp, 00000000-00000400.00000001.246589.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp" Found registry modification API: "RegCreateKeyW" in "00000000-00001312.00000001.246586.043E0000.00000040.mdmp, 00000000-00001312.00000001.246586.04E20000.00000040.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00001312.00000001.246586.04E20000.00000040.mdmp" Found registry modification API: "RegCreateKeyW" in "00000000-00003928.00000000.246917.04580000.00000040.mdmp, 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp" Found registry modification API: "RegCreateKeyW" in "00000000-00004044.00000000.244979.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp" Found registry modification API: "RegCreateKeyW" in "00000000-00004656.00000000.246912.04C10000.00000040.mdmp, 00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp"4a:Ta7e,Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; File: "MSOCF.dll") Found reference to API "EnumDependentServicesW" (Indicator: "EnumDependentServices"; File: "MSOCF.dll") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; File: "MSOCF.dll") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; File: "MSOCF.dll") Found reference to API "K32EnumDeviceDrivers" (Indicator: "EnumDeviceDrivers"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "K32EnumDeviceDrivers" (Indicator: "EnumDeviceDrivers"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "K32EnumDeviceDrivers" (Indicator: "EnumDeviceDrivers"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "K32EnumDeviceDrivers" (Indicator: "EnumDeviceDrivers"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "K32EnumDeviceDrivers" (Indicator: "EnumDeviceDrivers"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "K32EnumDeviceDrivers" (Indicator: "EnumDeviceDrivers"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")4b:Ta8e,file/memory contains long string(File: "azroleui.dll") file/memory contains long string(File: "87JH27UD.dll") file/memory contains long string(File: "adrclient.dll") file/memory contains long string(File: "acwow64.dll") file/memory contains long string(File: "at.exe") Found string "GetCommandLineA" (Source: "00000000-00000008.00000000.246917.044C0000.00000040.mdmp, 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "GetCommandLineA" (Source: "00000000-00000400.00000000.244980.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.043E0000.00000040.mdmp, 00000000-00000400.00000001.246589.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "GetCommandLineA" (Source: "00000000-00001312.00000001.246586.043E0000.00000040.mdmp, 00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found string "GetCommandLineA" (Source: "00000000-00003928.00000000.246917.04580000.00000040.mdmp, 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00004044.00000000.244979.00EB9000.00000002.mdmp, 00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found string "GetCommandLineA" (Source: "00000000-00004044.00000000.244979.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp, 00000000-00004044.00000001.246587.728B4000.00000002.mdmp") Found string "GetCommandLineA" (Source: "00000000-00004656.00000000.246912.04C10000.00000040.mdmp, 00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found string "GetCommandLineW" (Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")4c:T4700,"rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007008) "rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00004044) "rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000400) "rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001312) "rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004656) "rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005276) "rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter avicap32.dll (UID: 00000000-00003928) "rundll32.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter Ws2_32.dll (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000008) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000008)4d:T597,"SELECT displayName FROM AntiVirusProduct" (Source: 00000000-00003928-00002714-2863972387, Indicator: "select displayname from antivirusproduct") "SELECT displayName FROM AntiVirusProduct" (Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp, Indicator: "select displayname from antivirusproduct") "SELECT displayName FROM AntiVirusProduct" (Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp, Indicator: "select displayname from antivirusproduct") "SELECT displayName FROM AntiVirusProduct" (Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp, Indicator: "select displayname from antivirusproduct") "SELECT displayName FROM AntiVirusProduct" (Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp, Indicator: "select displayname from antivirusproduct") "SELECT displayName FROM AntiVirusProduct" (Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp, Indicator: "select displayname from antivirusproduct") "SELECT displayName FROM AntiVirusProduct" (Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp, Indicator: "select displayname from antivirusproduct")4e:T492,Found reference to API "CloseServiceHandle" (Indicator: "CloseServiceHandle"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "CloseServiceHandle" (Indicator: "CloseServiceHandle"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "CloseServiceHandle" (Indicator: "CloseServiceHandle"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "CloseServiceHandle" (Indicator: "CloseServiceHandle"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "CloseServiceHandle" (Indicator: "CloseServiceHandle"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "CloseServiceHandle" (Indicator: "CloseServiceHandle"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")4f:T1325,Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; File: "MSOCF.dll") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000008.00000000.246917.00690000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000008.00000000.246917.00690000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000008.00000000.246917.00690000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000008.00000000.246917.00690000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000008.00000000.246917.044C0000.00000040.mdmp, 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "PsSetCreateProcessNotifyRoutineEx" (Indicator: "CreateProcess"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000400.00000000.244980.00920000.00000004.mdmp, 00000000-00000400.00000001.246589.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000400.00000000.244980.00920000.00000004.mdmp, 00000000-00000400.00000001.246589.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000400.00000000.244980.00920000.00000004.mdmp, 00000000-00000400.00000001.246589.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000400.00000000.244980.00920000.00000004.mdmp, 00000000-00000400.00000001.246589.00920000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000400.00000000.244980.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.043E0000.00000040.mdmp, 00000000-00000400.00000001.246589.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "PsSetCreateProcessNotifyRoutineEx" (Indicator: "CreateProcess"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001312.00000000.244981.00920000.00000004.mdmp, 00000000-00001312.00000001.246586.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001312.00000000.244981.00920000.00000004.mdmp, 00000000-00001312.00000001.246586.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001312.00000000.244981.00920000.00000004.mdmp, 00000000-00001312.00000001.246586.00920000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001312.00000000.244981.00920000.00000004.mdmp, 00000000-00001312.00000001.246586.00920000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00001312.00000001.246586.043E0000.00000040.mdmp, 00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "PsSetCreateProcessNotifyRoutineEx" (Indicator: "CreateProcess"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003928.00000000.246917.00B00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003928.00000000.246917.00B00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003928.00000000.246917.00B00000.00000004.mdmp")50:T643,Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "MSOCF.dll") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; File: "MSOCF.dll") Found reference to API "SHCreateDirectoryExW" (Indicator: "CreateDirectory"; File: "MSOCF.dll") Found reference to API "_SaveBootDebugRequest: zwCreateDirectory: 0x%x" (Indicator: "CreateDirectory"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "_SaveBootDebugRequest: zwCreateDirectory: 0x%x" (Indicator: "CreateDirectory"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "_SaveBootDebugRequest: zwCreateDirectory: 0x%x" (Indicator: "CreateDirectory"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "_SaveBootDebugRequest: zwCreateDirectory: 0x%x" (Indicator: "CreateDirectory"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "_SaveBootDebugRequest: zwCreateDirectory: 0x%x" (Indicator: "CreateDirectory"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "_SaveBootDebugRequest: zwCreateDirectory: 0x%x" (Indicator: "CreateDirectory"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")51:T9f6,Found reference to API "NtFsControlFile" (Indicator: "FsControlFile"; File: "MSOCF.dll") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; File: "MSOCF.dll") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; File: "MSOCF.dll") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "IoCreateDevice" (Indicator: "IoCreateDevice"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "IoCreateDevice" (Indicator: "IoCreateDevice"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "IoCreateDevice" (Indicator: "IoCreateDevice"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "IoCreateDevice" (Indicator: "IoCreateDevice"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "IoCreateDevice" (Indicator: "IoCreateDevice"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "IoCreateDevice" (Indicator: "IoCreateDevice"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")52:T69f,Found reference to API "RegUnLoadKeyW" (Indicator: "RegUnLoadKey"; File: "MSOCF.dll") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00000008.00000000.246917.044C0000.00000040.mdmp, 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00000400.00000000.244980.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.043E0000.00000040.mdmp, 00000000-00000400.00000001.246589.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00001312.00000001.246586.043E0000.00000040.mdmp, 00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00003928.00000000.246917.04580000.00000040.mdmp, 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00004044.00000000.244979.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00004656.00000000.246912.04C10000.00000040.mdmp, 00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")53:Ta4f,Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "MSOCF.dll") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "MSOCF.dll") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "MSOCF.dll") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000008.00000000.246917.00690000.00000004.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000400.00000000.244980.00920000.00000004.mdmp, 00000000-00000400.00000001.246589.00920000.00000004.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001312.00000000.244981.00920000.00000004.mdmp, 00000000-00001312.00000001.246586.00920000.00000004.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003928.00000000.246917.00B00000.00000004.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004044.00000000.244979.00F00000.00000004.mdmp, 00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004656.00000000.246912.03110000.00000004.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp")54:Tf1b,Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "MSOCF.dll") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "MSOCF.dll") Found reference to API "FindResourceExA" (Indicator: "FindResource"; File: "MSOCF.dll") Found reference to API "AuthzFreeResourceManager" (Indicator: "FreeResource"; File: "MSOCF.dll") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp")55:Tb42,"MSOCF.dll" contains export function called "??0CToolbarData@MsoCF@@QAE@XZ" at ordinal 1 "MSOCF.dll" contains export function called "??0CWindow@MsoCF@@QAE@XZ" at ordinal 2 "MSOCF.dll" contains export function called "??1CToolbarData@MsoCF@@QAE@XZ" at ordinal 3 "MSOCF.dll" contains export function called "??1CWindow@MsoCF@@UAE@XZ" at ordinal 4 "MSOCF.dll" contains export function called "??1CWindowEventArgs@MsoCF@@QAE@XZ" at ordinal 5 "MSOCF.dll" contains export function called "?Allocate@Allocator@Memory@MsoCF@@YGPAXIW4FailureStrategy@23@@Z" at ordinal 6 "MSOCF.dll" contains export function called "?AppendArrayOfCharactersToWz@Strings@MsoCF@@YGXPB_WHAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAH@Z" at ordinal 7 "MSOCF.dll" contains export function called "?ClonePropertySet_Imp@IPropertySet@MsoCF@@UAGXPAPAU12@@Z" at ordinal 8 "MSOCF.dll" contains export function called "?Copy@Memory@MsoCF@@YGXPBXPAXI@Z" at ordinal 9 "MSOCF.dll" contains export function called "?CopyWzToWz@Strings@MsoCF@@YGXPB_WAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAH@Z" at ordinal 10 "MSOCF.dll" contains export function called "?Copy_MakeDeep_ComplexType@CPropertyData@MsoCF@@SGXQAXW4PropertyType@2@@Z" at ordinal 11 "MSOCF.dll" contains export function called "?Create@CWindow@MsoCF@@QAGXPB_W0KKHHIIPAUHWND__@@PAUHINSTANCE__@@@Z" at ordinal 12 "MSOCF.dll" contains export function called "?CreateActionManager@MsoCF@@YGXPAPAUIActionManager@1@@Z" at ordinal 13 "MSOCF.dll" contains export function called "?CreatePropertySet@MsoCF@@YGXPAPAUIPropertySet@1@PAU21@@Z" at ordinal 14 "MSOCF.dll" contains export function called "?CreateTheApp@Frame@MsoCF@@YGXAAUCreateTheAppArgs@12@@Z" at ordinal 15 "MSOCF.dll" contains export function called "?Destroy@CWindow@MsoCF@@QBGXXZ" at ordinal 16 "MSOCF.dll" contains export function called "?DisablePropertiesTypeSafety@MsoCF@@YGXXZ" at ordinal 17 "MSOCF.dll" contains export function called "?FGet@Properties@MsoCF@@YG_NPAUIPropertySet@2@PBUPropertyInfo@2@PAXHW4PropertyType@2@@Z" at ordinal 18 "MSOCF.dll" contains export function called "?Finish@Frame@MsoCF@@YGXXZ" at ordinal 19 "MSOCF.dll" contains export function called "?Finish@Utilities@MsoCF@@YGXXZ" at ordinal 20 "MSOCF.dll" contains export function called "?Free@Allocator@Memory@MsoCF@@YGXPAX@Z" at ordinal 21 "MSOCF.dll" contains export function called "?FreeAndZero_ComplexType@CPropertyData@MsoCF@@SGXPAXW4PropertyType@2@@Z" at ordinal 22 "MSOCF.dll" contains export function called "?Get@Properties@MsoCF@@YGXPAUIPropertySet@2@PBIPAVCPropertyValue@2@H@Z" at ordinal 23 "MSOCF.dll" contains export function called "?GetIterator_Imp@IPropertySet@MsoCF@@MAGXPAPAUIPropertySetIterator@2@@Z" at ordinal 24 "MSOCF.dll" contains export function called "?GetMsoHinst@MsoCF@@YGPAUHINSTANCE__@@XZ" at ordinal 2556:T1a44,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00000400.00000001.246589.00920000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00001312.00000001.246586.00920000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "istry\Machine\System\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00003928.00000000.246917.00B00000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00003928.00000000.246917.00B00000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp 00000000-00004656.00000000.246912.05470000.00000040.mdmp 00000000-00004656.00000000.246912.05580000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp 00000000-00004656.00000000.246912.05470000.00000040.mdmp 00000000-00004656.00000000.246912.05580000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp 00000000-00004656.00000000.246912.05470000.00000040.mdmp 00000000-00004656.00000000.246912.05580000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp 00000000-00004656.00000000.246912.05470000.00000040.mdmp 00000000-00004656.00000000.246912.05580000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp 00000000-00004656.00000000.246912.05470000.00000040.mdmp 00000000-00004656.00000000.246912.05580000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp 00000000-00004656.00000000.246912.05470000.00000040.mdmp 00000000-00004656.00000000.246912.05580000.00000040.mdmp "Registry\Machine\System\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00005276.00000000.246914.00AC0000.00000004.mdmp57:T81c,Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\MyUniqueApp_SingleInstance" Process rundll32.exe created mutex with name "SM0:7008:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:7008:168:WilStaging_02" Process rundll32.exe created mutex with name "Global\MyUniqueApp_SingleInstance" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7008:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7008:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4044:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4044:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:4044:168:WilStaging_02" Process rundll32.exe created mutex with name "eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001" Process rundll32.exe created mutex with name "SM0:4044:168:WilStaging_02" Process rundll32.exe created mutex with name "\BaseNamedObjects\MyUniqueApp_SingleInstance" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:400:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:400:168:WilStaging_02" Process rundll32.exe created mutex with name "SM0:400:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:400:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1312:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1312:168:WilStaging_02" Process rundll32.exe created mutex with name "SM0:1312:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:1312:168:WilStaging_02"58:Ta9b,Antivirus vendors marked dropped file "aclui.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "AuthFWSnapin.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "accessibilitycpl.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "cdp.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "AcGenral.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "cmiv2.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "batmeter.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "ActiveSyncProvider.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "AppVEntSubsystems32.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "AppxPackaging.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "AzureSettingSyncProvider.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "AudioEng.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"), Antivirus vendors marked dropped file "AudioSes.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"), Antivirus vendors marked dropped file "aadtb.dll" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "cdprt.dll" as clean (type is "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "bcastdvr.exe" as clean (type is "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"), Antivirus vendors marked dropped file "autochk.exe" as clean (type is "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"), Antivirus vendors marked dropped file "autoconv.exe" as clean (type is "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"), Antivirus vendors marked dropped file "cdosys.dll" as clean (type is "PE32 executable for MS Windows 6.01 (DLL) Intel i386 5 sections")59:Tca0,"MSOCF.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "AuthFWSnapin.dll" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "accessibilitycpl.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "cdp.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "AcGenral.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "cmiv2.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "batmeter.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "ActiveSyncProvider.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "AppVEntSubsystems32.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "AppxPackaging.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "AzureSettingSyncProvider.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "AudioEng.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "AudioSes.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "aadtb.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "cdprt.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "bcastdvr.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "autochk.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "autoconv.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "cdosys.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "adtschema.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH "autofmt.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "azroles.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF5a:T2b04,"SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00000400.00000001.246589.00920000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00001312.00000001.246586.00920000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00003928.00000000.246917.00B00000.00000004.mdmp "istry\Machine\System\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00003928.00000000.246917.00B00000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004656.00000000.246912.05470000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004656.00000000.246912.05470000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004656.00000000.246912.05470000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004656.00000000.246912.05470000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004656.00000000.246912.05470000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004656.00000000.246912.05470000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00004656.00000000.246912.05580000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00004656.00000000.246912.05580000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004656.00000000.246912.05580000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00004656.00000000.246912.05580000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004656.00000000.246912.05580000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00004656.00000000.246912.05580000.00000040.mdmp "Registry\Machine\System\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00005276.00000000.246914.00AC0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00005276.00000000.246914.050E0000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00005276.00000000.246914.050E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005276.00000000.246914.050E0000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005276.00000000.246914.050E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005276.00000000.246914.050E0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00005276.00000000.246914.050E0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00005276.00000000.246914.05220000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00005276.00000000.246914.05220000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005276.00000000.246914.05220000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005276.00000000.246914.05220000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005276.00000000.246914.05220000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00005276.00000000.246914.05220000.00000040.mdmp "SYSTEM\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00007008.00000001.246585.005C0000.00000004.mdmp "istry\Machine\System\CurrentControlSet\Services\EmbeddedDriverService" in Source: 00000000-00007008.00000001.246585.005C0000.00000004.mdmp "SYSTEM\CurrentControlSet\Services\" in Source: 00000000-00007008.00000001.246585.04BB0000.00000040.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender" in Source: 00000000-00007008.00000001.246585.04BB0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007008.00000001.246585.04BB0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007008.00000001.246585.04BB0000.00000040.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007008.00000001.246585.04BB0000.00000040.mdmp "\Registry\Machine\System\CurrentControlSet\Services\" in Source: 00000000-00007008.00000001.246585.04BB0000.00000040.mdmp5b:Td16,"rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 728d0000 "rundll32.exe" loaded module "NTDLL" at base 77440000 "rundll32.exe" loaded module "WS2_32.DLL" at base 74a90000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72d90000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 742b0000 "rundll32.exe" loaded module "USER32.DLL" at base 74440000 "rundll32.exe" loaded module "ADVAPI32.DLL" at base 75310000 "rundll32.exe" loaded module "WINMM.DLL" at base 72870000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 72820000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 74380000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 72800000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 727e0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 727d0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72780000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72770000 "rundll32.exe" loaded module "GDI32.DLL" at base 75560000 "rundll32.exe" loaded module "OLE32.DLL" at base 75210000 "rundll32.exe" loaded module "OLEAUT32.DLL" at base 76fd0000 "rundll32.exe" loaded module "BCRYPT.DLL" at base 72e60000 "rundll32.exe" loaded module "SHLWAPI.DLL" at base 76a60000 "rundll32.exe" loaded module "GDIPLUS.DLL" at base 73c80000 "rundll32.exe" loaded module "DXGI.DLL" at base 726d0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 748b0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 748b0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 748b0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 748b0000 "rundll32.exe" loaded module "KERNEL32" at base 742b0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 748b0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 748b0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 748b0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74b00000 "rundll32.exe" loaded module "NTDLL.DLL" at base 77440000 "rundll32.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 726b0000 "rundll32.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 745c0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a50000 "rundll32.exe" loaded module "%WINDIR%\SYSWOW64\DEVENUM.DLL" at base 726b0000 "rundll32.exe" loaded module "SETUPAPI.DLL" at base 73e80000 "rundll32.exe" loaded module "MSDMO.DLL" at base 726a0000 "rundll32.exe" loaded module "IMM32.DLL" at base 76c50000 "rundll32.exe" loaded module "AVICAP32.DLL" at base 72680000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 748b0000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72690000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72610000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72550000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 748b0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 748b00005c:T1451,"MSOCF.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MSOCF.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MSOCF.dll" was detected as "Microsoft Linker" and name: "Linker" "AuthFWSnapin.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AuthFWSnapin.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AuthFWSnapin.dll" was detected as "Microsoft Linker" and name: "Linker" "accessibilitycpl.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "accessibilitycpl.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "accessibilitycpl.dll" was detected as "Microsoft Linker" and name: "Linker" "cdp.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "cdp.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "cdp.dll" was detected as "Microsoft Linker" and name: "Linker" "AcGenral.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AcGenral.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AcGenral.dll" was detected as "Microsoft Linker" and name: "Linker" "cmiv2.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "cmiv2.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "cmiv2.dll" was detected as "Microsoft Linker" and name: "Linker" "batmeter.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "batmeter.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "batmeter.dll" was detected as "Microsoft Linker" and name: "Linker" "ActiveSyncProvider.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ActiveSyncProvider.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ActiveSyncProvider.dll" was detected as "Microsoft Linker" and name: "Linker" "AppVEntSubsystems32.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AppVEntSubsystems32.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AppVEntSubsystems32.dll" was detected as "Microsoft Linker" and name: "Linker" "AppxPackaging.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AppxPackaging.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AppxPackaging.dll" was detected as "Microsoft Linker" and name: "Linker" "AzureSettingSyncProvider.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AzureSettingSyncProvider.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AzureSettingSyncProvider.dll" was detected as "Microsoft Linker" and name: "Linker" "AudioEng.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AudioEng.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AudioEng.dll" was detected as "Microsoft Linker" and name: "Linker" "AudioSes.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AudioSes.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AudioSes.dll" was detected as "Microsoft Linker" and name: "Linker" "aadtb.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "aadtb.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "aadtb.dll" was detected as "Microsoft Linker" and name: "Linker" "cdprt.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "cdprt.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "cdprt.dll" was detected as "Microsoft Linker" and name: "Linker" "bcastdvr.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "bcastdvr.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "bcastdvr.exe" was detected as "Microsoft Linker" and name: "Linker" "autochk.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "autochk.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "autochk.exe" was detected as "Microsoft Linker" and name: "Linker" "autoconv.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "autoconv.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "autoconv.exe" was detected as "Microsoft Linker" and name: "Linker" "cdosys.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "cdosys.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "cdosys.dll" was detected as "Microsoft Linker" and name: "Linker" "adtschema.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "adtschema.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "adtschema.dll" was detected as "Microsoft Linker" and name: "Linker" "autofmt.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "autofmt.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "autofmt.exe" was detected as "Microsoft Linker" and name: "Linker" "azroles.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "azroles.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "azroles.dll" was detected as "Microsoft Linker" and name: "Linker"5d:T454,"rundll32.exe" touched "System Device Enumerator" (Path: "HKCU\WOW6432NODE\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}") "rundll32.exe" touched "VFW Capture Class Manager" (Path: "HKCU\WOW6432NODE\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\TREATAS") "rundll32.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "rundll32.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "rundll32.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "rundll32.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "rundll32.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "rundll32.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")5e:T5f5,"AuthFWSnapin.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "accessibilitycpl.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "cdp.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AcGenral.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "cmiv2.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "batmeter.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "ActiveSyncProvider.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AppVEntSubsystems32.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AppxPackaging.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AzureSettingSyncProvider.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AudioEng.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AudioSes.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "aadtb.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "cdprt.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "bcastdvr.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "autochk.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "autoconv.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "cdosys.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "adtschema.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "autofmt.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "azroles.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"5f:T596,"MSOCF.dll" has an executable section named ".text" "AuthFWSnapin.dll" has an executable section named ".text" "accessibilitycpl.dll" has an executable section named ".text" "cdp.dll" has an executable section named ".text" "AcGenral.dll" has an executable section named "TEXT" "AcGenral.dll" has an executable section named ".text" "cmiv2.dll" has an executable section named ".text" "batmeter.dll" has an executable section named ".text" "ActiveSyncProvider.dll" has an executable section named ".text" "AppVEntSubsystems32.dll" has an executable section named ".text" "AppxPackaging.dll" has an executable section named ".text" "AzureSettingSyncProvider.dll" has an executable section named ".text" "AudioEng.dll" has an executable section named ".text" "AudioEng.dll" has an executable section named "RT_CODE" "AudioSes.dll" has an executable section named ".text" "AudioSes.dll" has an executable section named "RT_CODE" "aadtb.dll" has an executable section named ".text" "aadtb.dll" has an executable section named ".orpc" "cdprt.dll" has an executable section named ".text" "bcastdvr.exe" has an executable section named ".text" "autochk.exe" has an executable section named ".text" "autoconv.exe" has an executable section named ".text" "cdosys.dll" has an executable section named ".text" "autofmt.exe" has an executable section named ".text" "azroles.dll" has an executable section named ".text"60:T5a8,"MSOCF.dll" has an writable section named ".data" "accessibilitycpl.dll" has an writable section named ".data" "accessibilitycpl.dll" has an writable section named ".didat" "cdp.dll" has an writable section named ".data" "cdp.dll" has an writable section named ".didat" "AcGenral.dll" has an writable section named ".data" "AcGenral.dll" has an writable section named ".didat" "cmiv2.dll" has an writable section named ".data" "batmeter.dll" has an writable section named ".data" "batmeter.dll" has an writable section named ".didat" "ActiveSyncProvider.dll" has an writable section named ".data" "ActiveSyncProvider.dll" has an writable section named ".didat" "AppVEntSubsystems32.dll" has an writable section named ".data" "AppVEntSubsystems32.dll" has an writable section named ".detourd" "AppxPackaging.dll" has an writable section named ".data" "AppxPackaging.dll" has an writable section named ".didat" "AzureSettingSyncProvider.dll" has an writable section named ".data" "AzureSettingSyncProvider.dll" has an writable section named ".didat" "AudioEng.dll" has an writable section named "RT_BSS" "AudioEng.dll" has an writable section named ".data" "AudioEng.dll" has an writable section named ".didat" "AudioEng.dll" has an writable section named "RT_DATA" "AudioSes.dll" has an writable section named "RT_BSS" "AudioSes.dll" has an writable section named ".data" "AudioSes.dll" has an writable section named ".didat"61:T3520,"MSOCF.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10006d5e,call 0x1000bc43,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10006d73,add esp, 0xc,pop ebp,ret 0xc,push 0xc,push 0x10019190,call 0x10007e40,xor eax, eax,inc eax,mov esi, dword ptr [ebp + 0xc],test esi, esi,jne 0x10006d95,cmp dword ptr [0x1001cee0], esi,je 0x10006e79,and dword ptr [ebp - 4], 0,cmp esi, 1,je 0x10006da3,cmp esi, 2,jne 0x10006dd8,mov ecx, dword ptr [0x10015494],test ecx, ecx,je 0x10006db9,push dword ptr [ebp + 0x10],push esi,push dword ptr [ebp + 8]," "AuthFWSnapin.dll" file has an entrypoint instructions - "jmp dword ptr [0x10002000],add byte ptr [eax], al,add byte ptr [eax], al,add dword ptr [eax], eax,add byte ptr [eax], al,add al, byte ptr [eax],add byte ptr [eax], al,add eax, dword ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add eax, dword ptr [eax],add byte ptr [eax], al,add dword ptr [eax], eax,add byte ptr [eax], al,add al, byte ptr [eax],add byte ptr [eax], al,add eax, 0x6000000,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al,pop es,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al,add al, byte ptr [eax],add byte ptr [eax], al,add dword ptr [eax], eax,add byte ptr [eax], al,add eax, dword ptr [eax],add byte ptr [eax], al,add byte ptr [eax - 0x70f1f40], al,cld ," "accessibilitycpl.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10027470,call 0x10027b03,pop ebp,jmp 0x10027496,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x10027492,push dword ptr [ebp + 0xc],push eax,call 0x100279ab,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x10029680,call 0x10027bac,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x100274bb,mov dword ptr [0x1002a3f0], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x100274d2," "cdp.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10232330,call 0x102323b2,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x102321d7,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x102d7404],bnd jne 0x1023235b,bnd ret ,bnd jmp 0x10232aa3,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x14,and dword ptr [ebp - 0xc], 0,lea eax, [ebp - 0xc],and dword ptr [ebp - 8], 0,push eax,call dword ptr [0x102da458],mov eax, dword ptr [ebp - 8],xor eax, dword ptr [ebp - 0xc],mov dword ptr [ebp - 4], eax," "AcGenral.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x79030b40,call 0x790316d3,pop ebp,jmp 0x79030b66,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x79030b62,push dword ptr [ebp + 0xc],push eax,call 0x7903157c,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x7909fa20,call 0x7903177c,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x79030b8b,mov dword ptr [0x790a8f74], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x79030ba2," "cmiv2.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10151780,call 0x10152543,pop ebp,jmp 0x101517a6,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x101517a2,push dword ptr [ebp + 0xc],push eax,call 0x101523eb,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x101a16e0,call 0x101525ec,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x101517cb,mov dword ptr [0x101a3e9c], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x101517e2," "batmeter.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x5e501ec0,call 0x5e5026a3,pop ebp,jmp 0x5e501ee6,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x5e501ee2,push dword ptr [ebp + 0xc],push eax,call 0x5e502549,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x5e506348,call 0x5e50274c,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x5e501f0b,mov dword ptr [0x5e507014], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x5e501f22," "ActiveSyncProvider.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1003c310,call 0x1003ca83,pop ebp,jmp 0x1003c336,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x1003c332,push dword ptr [ebp + 0xc],push eax,call 0x1003c92e,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x1015d268,call 0x1003cb2c,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x1003c35b,mov dword ptr [0x1015f320], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x1003c372," "AppVEntSubsystems32.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100fab30,call 0x100fb48a,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100fa9d7,add esp, 0xc,pop ebp,ret 0xc,cmp ecx, dword ptr [0x10153734],bnd jne 0x100fab50,bnd ret ,bnd jmp 0x100faf48,mov edi, edi,push ebp,mov ebp, esp,jmp 0x100fab6a,push dword ptr [ebp + 8],call 0x101034db,pop ecx,test eax, eax,je 0x100fab79,push dword ptr [ebp + 8],call 0x100ff1a1,pop ecx,test eax, eax,je 0x100fab5d,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x100fb7d5," "AppxPackaging.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1004df80,call 0x1004d2f0,push dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],mov ecx, dword ptr [ebp + 8],call 0x1004a6ba,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,push esi,mov esi, edx,mov edx, dword ptr [ebp + 0xc],push edi,mov edi, ecx,call 0x100615ff,push dword ptr [ebp + 0xc],mov edx, esi,mov ecx, edi,push 1,push dword ptr [ebp + 4],push 0,push 0,push dword ptr [ebp + 8],call 0x1004b59a,pop edi,pop esi,pop ebp,ret 8,mov edi, edi,push ebp,mov ebp, esp,push dword ptr [ebp + 0xc],push 1,push dword ptr [ebp + 4],push 0,push 0," "AzureSettingSyncProvider.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100d1430,call 0x100d2003,pop ebp,jmp 0x100d1456,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x100d1452,push dword ptr [ebp + 0xc],push eax,call 0x100d1eac,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x10121570,call 0x100d20ac,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x100d147b,mov dword ptr [0x10124cec], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x100d1492," "AudioEng.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1006b890,call 0x1006c388,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1006b737,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x10117364],bnd jne 0x1006b8bb,bnd ret ,bnd jmp 0x1006ba60,push 0x10,push 0x1010d090,call 0x1006c630,mov byte ptr [ebp - 0x1d], 0,mov ebx, dword ptr [ebp + 0xc],mov eax, ebx,mov edi, dword ptr [ebp + 0x10],imul eax, edi,mov esi, dword ptr [ebp + 8],add esi, eax,mov dword ptr [ebp + 8], esi," "AudioSes.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1003d050,call 0x1003db6d,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1003cef7,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x100d26b4],bnd jne 0x1003d07b,bnd ret ,bnd jmp 0x1003d3e7,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push ebp,mov ebp, esp,push dword ptr [ebp + 0x14],push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8]," "aadtb.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1007d410,call 0x1007dd33,pop ebp,jmp 0x1007d436,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x1007d432,push dword ptr [ebp + 0xc],push eax,call 0x1007dbe0,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x100b9c10,call 0x1007d9f0,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x1007d45b,mov dword ptr [0x100be080], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x1007d472," "cdprt.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100b6970,call 0x100b7060,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100b6817,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x100d4b04],bnd jne 0x100b699b,bnd ret ,bnd jmp 0x100b7403,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,call 0x100b69f6,push 0,call 0x100b6e2c,pop ecx,test al, al,je 0x100b69cf," "bcastdvr.exe" file has an entrypoint instructions - "call 0x4b96a3,jmp 0x4b8b23,jmp dword ptr [0x4c9590],cmp ecx, dword ptr [0x4c7ea4],jne 0x4b8cfb,ret 0,jmp 0x4b8d30,jmp dword ptr [0x4c95b0],mov edi, edi,push ebp,mov ebp, esp,push 0,call dword ptr [0x4c9208],push dword ptr [ebp + 8],call dword ptr [0x4c9210],push 0xc0000409,call dword ptr [0x4c92ac],push eax,call dword ptr [0x4c92a4],pop ebp,ret ,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x324,mov dword ptr [0x4c8078], eax," "autochk.exe" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,call 0x488b85,mov ecx, dword ptr [ebp + 8],call 0x4087a0,int3 ,mov edi, edi,push ebp,mov ebp, esp,push ebx,push esi,xor esi, esi,mov ebx, ecx,test edx, edx,je 0x408a7a,cmp edx, 0x7fffffff,jbe 0x408a7f,mov esi, 0x80070057,test esi, esi,js 0x408ab4,push edi,push dword ptr [ebp + 0xc],lea edi, [edx - 1],xor esi, esi,push dword ptr [ebp + 8],push edi,push ebx,call dword ptr [0x48e08c],add esp, 0x10,test eax, eax,js 0x408aa6,cmp eax, edi,ja 0x408aa6,jne 0x408ab1,jmp 0x408aab,mov esi, 0x8007007a,xor eax, eax,mov word ptr [ebx + edi*2], ax,pop edi,jmp 0x408abd," "autoconv.exe" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,call 0x484513,mov ecx, dword ptr [ebp + 8],call 0x40650e,int3 ,mov edi, edi,push ebp,mov ebp, esp,push ebx,push esi,xor esi, esi,mov ebx, ecx,test edx, edx,je 0x4067ea,cmp edx, 0x7fffffff,jbe 0x4067ef,mov esi, 0x80070057,test esi, esi,js 0x406824,push edi,push dword ptr [ebp + 0xc],lea edi, [edx - 1],xor esi, esi,push dword ptr [ebp + 8],push edi,push ebx,call dword ptr [0x489058],add esp, 0x10,test eax, eax,js 0x406816,cmp eax, edi,ja 0x406816,jne 0x406821,jmp 0x40681b,mov esi, 0x8007007a,xor eax, eax,mov word ptr [ebx + edi*2], ax,pop edi,jmp 0x40682d," "cdosys.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x6f915aa0,call 0x6f916683,pop ebp,jmp 0x6f915ac6,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x6f915ac2,push dword ptr [ebp + 0xc],push eax,call 0x6f916526,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x6f927c80,call 0x6f91672c,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x6f915aeb,mov dword ptr [0x6f92dfb4], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x6f915b02," "adtschema.dll" file has an entrypoint instructions - "dec ebp,pop edx,nop ,add byte ptr [ebx], al,add byte ptr [eax], al,add byte ptr [eax + eax], al,add byte ptr [eax], al," "autofmt.exe" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,call 0x47f4bf,mov ecx, dword ptr [ebp + 8],call 0x406008,int3 ,mov edi, edi,push ebp,mov ebp, esp,push ebx,push esi,xor esi, esi,mov ebx, ecx,test edx, edx,je 0x4062ea,cmp edx, 0x7fffffff,jbe 0x4062ef,mov esi, 0x80070057,test esi, esi,js 0x406324,push edi,push dword ptr [ebp + 0xc],lea edi, [edx - 1],xor esi, esi,push dword ptr [ebp + 8],push edi,push ebx,call dword ptr [0x484048],add esp, 0x10,test eax, eax,js 0x406316,cmp eax, edi,ja 0x406316,jne 0x406321,jmp 0x40631b,mov esi, 0x8007007a,xor eax, eax,mov word ptr [ebx + edi*2], ax,pop edi,jmp 0x40632d," "azroles.dll" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10060be0,call 0x100618a3,pop ebp,jmp 0x10060c06,mov edi, edi,push ebp,mov ebp, esp,mov eax, 0xe06d7363,cmp dword ptr [ebp + 8], eax,jne 0x10060c02,push dword ptr [ebp + 0xc],push eax,call 0x10061748,pop ecx,pop ecx,pop ebp,ret ,xor eax, eax,pop ebp,ret ,push 0x30,push 0x100661d0,call 0x1006194c,mov dword ptr [ebp - 0x20], 1,xor esi, esi,mov dword ptr [ebp - 4], esi,mov eax, dword ptr [ebp + 0xc],cmp eax, 1,ja 0x10060c2b,mov dword ptr [0x10068718], eax,cmp dword ptr [ebp + 0xc], 0,jne 0x10060c42,"62:T6ab,"MSOCF.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "accessibilitycpl.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "cdp.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AcGenral.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "cmiv2.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "batmeter.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "ActiveSyncProvider.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AppVEntSubsystems32.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AppxPackaging.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AzureSettingSyncProvider.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AudioEng.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AudioSes.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "aadtb.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "cdprt.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "bcastdvr.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "autochk.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "autoconv.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "cdosys.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "adtschema.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "autofmt.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "azroles.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE63:T513,Found reference to API "CreateServiceW" (Indicator: "CreateService"; File: "MSOCF.dll") Found reference to API "RtlCreateServiceSid" (Indicator: "CreateService"; File: "MSOCF.dll") Found reference to API "CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "CreateServiceA" (Indicator: "CreateService"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")64:T58ff,"BingMaps.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "aclui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AuthFWSnapin.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "accessibilitycpl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "cdp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcGenral.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "cmiv2.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "batmeter.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActiveSyncProvider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppVEntSubsystems32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "AppxPackaging.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AzureSettingSyncProvider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AudioEng.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "AudioSes.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "aadtb.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "cdprt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "bcastdvr.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- [targetUID: N/A] "autochk.exe" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"- [targetUID: N/A] "autoconv.exe" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"- [targetUID: N/A] "cdosys.dll" has type "PE32 executable for MS Windows 6.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adtschema.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "autofmt.exe" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"- [targetUID: N/A] "azroles.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BingOnlineServices.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "appwiz.cpl" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppointmentApis.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "certca.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "apphelp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00000400] "AppxApplicabilityEngine.dll" has type "PE32 executable for MS Windows 6.01 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppContracts.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppXDeploymentClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActionCenterCPL.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcSpecfc.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "advapi32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: 00000000-00000400] "authui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AdmTmpl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "ActivationManager.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppResolver.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "certCredProvider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BcastDVRBroker.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "catsrvut.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "catsrv.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AUDIOKSE.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "AcLayers.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: 00000000-00000400] "appmgr.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AccountsRt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "bcryptprimitives.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00000400] "authfwcfg.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "certcli.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "azroleui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BCP47Langs.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "atmfd.dll" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 6 sections"- [targetUID: N/A] "AuthFWGP.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adsnt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppIdPolicyEngineApi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "biwinrt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "capauthz.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "actxprxy.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActionCenter.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BcastDVRClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AboveLockAppHost.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BioCredProv.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "audiodev.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppLockerCSP.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "activeds.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "bthprops.cpl" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AuditNativeSnapIn.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "accountaccessor.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "apds.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "aepic.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adsldpc.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "cemapi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "87JH27UD.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adsldp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppxAllUserStore.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "authz.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "basecsp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "bitsadmin.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 6 sections"- [targetUID: N/A] "AuthBroker.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BcastDVRCommon.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "appmgmts.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "altspace.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "AppxSip.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "aadauthhelper.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "cabview.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "autoplay.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "bcastdvr.proxy.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AppExtension.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BluetoothApis.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "CastingShellExt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppManagementConfiguration.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "CallHistoryClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BrowserSettingSync.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppointmentActivation.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "advpack.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "cabinet.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "btpanui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BitLockerCsp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AuthFWWizFwk.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "bcd.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "avifil32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adrclient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "bcrypt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: 00000000-00000400] "auditpolmsg.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "AuthBrokerUI.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "msimsg.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "CameraCaptureUI.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "adsmsext.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcXtrnal.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppCapture.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "atl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "bootcfg.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "amstream.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "CallButtons.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "asycfilt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "cca.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "avicap32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00004044] "acppage.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "CapabilityAccessManagerClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "comdlg32.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "ApiSetHost.AppExecutionAlias.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BackgroundMediaPolicy.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AuditPolicyGPInterop.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "cabapi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "auditpolcore.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AuthExt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "capiprovider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "bidispl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BWContextHandler.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AddressParser.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "appidapi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "amsi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adprovider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AtBroker.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "APHostClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "admwprox.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "ByteCodeGenerator.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "cdosys.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "windows.ui.xaml.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "BitsProxy.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "browcli.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "azman.msc" has type "Unknown"- [targetUID: N/A] "atmlib.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "acwow64.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AdaptiveCards.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "bthudtask.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 6 sections"- [targetUID: N/A] "atlthunk.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BackgroundTransferHost.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "AcWinRT.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "SyncRes.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "CameraSettingsUIHost.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- [targetUID: N/A] "Apphlpdm.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "aeevts.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "ActivationClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "aspnet_counters.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "auditpol.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "BthTelemetry.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "canonurl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "cacls.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "avrt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AppVClientPS.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "ahadmin.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "calc.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "aspperf.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AzSqlExt.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "at.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "catsrvps.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "bitsperf.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "appidtel.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "capisp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AnalogCommonProxyStub.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "attrib.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "CallButtons.ProxyStub.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "backgroundTaskHost.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "AppVTerminator.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "mlang.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "fms.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "AppVSentinel.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BamSettingsClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "browseui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "apprepapi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "acledit.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "comctl32.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "quickassist.exe.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "asferror.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "advapi32res.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "boot.sdi" has type "Unknown"- [targetUID: N/A] "activeds.tlb" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "bdaplgin.ax" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "EmbeddedDriverService.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 8 sections"- Location: [%TEMP%\EmbeddedDriverService.sys]- [targetUID: 00000000-00000400] "cero.rs" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "BOOTVID.DLL" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 7 sections"- [targetUID: N/A] "bopomofo.uce" has type "Unknown"- [targetUID: N/A] "ARP.EXE" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "amcompat.tlb" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "AppxProvisioning.xml" has type "Unknown"- [targetUID: N/A] "sys_cache.dat" has type "Unknown"- Location: [%TEMP%\sys_cache.dat]- [targetUID: 00000000-00000400] "12520850.cpx" has type "Unknown"- [targetUID: N/A] "12520437.cpx" has type "Unknown"- [targetUID: N/A] "@WirelessDisplayToast.png" has type "PNG image data 64 x 64 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "@VpnToastIcon.png" has type "PNG image data 64 x 64 4-bit colormap non-interlaced"- [targetUID: N/A] "@EnrollmentToastIcon.png" has type "PNG image data 71 x 71 8-bit gray+alpha non-interlaced"- [targetUID: N/A] "@AudioToastIcon.png" has type "PNG image data 44 x 44 8-bit gray+alpha non-interlaced"- [targetUID: N/A] "@BthpropsNotificationLogo.png" has type "PNG image data 32 x 32 8-bit/color RGBA non-interlaced"- [targetUID: N/A]65:T574,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")66:Tb1e,"BingMaps.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "aclui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AuthFWSnapin.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "accessibilitycpl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "cdp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcGenral.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "cmiv2.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "batmeter.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActiveSyncProvider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppVEntSubsystems32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "AppxPackaging.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AzureSettingSyncProvider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AudioEng.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "AudioSes.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "aadtb.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "cdprt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "cdosys.dll" has type "PE32 executable for MS Windows 6.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adtschema.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "azroles.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BingOnlineServices.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AppointmentApis.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "certca.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "apphelp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00000400] "AppxApplicabilityEngine.dll" has type "PE32 executable for MS Windows 6.01 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppContracts.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A]67:Td8a,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACINGFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CFGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "GLOBALFLAG"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "RUNDLL32.EXE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")68:T562,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Able to detect virtual machine (string) Matched sigs: Able to identify virtual/sandbox environment devices Matched sigs: Able to identify virtual/sandbox environment Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Possibly tries to evade analysis by sleeping multiple times Matched sigs: Calls an API typically used to find device information Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Able to perform sandbox evasion using APIs69:T46c,"rundll32.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "rundll32.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\WINLOGON.EXE" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSDTC.EXE" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\SIHOST.EXE" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\TASKHOSTW.EXE" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\WBEMCOMN.DLL" "rundll32.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\wbem\wbemcomn.dll" "rundll32.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\RUNTIMEBROKER.EXE" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\APPLICATIONFRAMEHOST.EXE" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\CONHOST.EXE"6a:T420,"rundll32.exe" trying to access non-existent file "C:\MSOCF.DLL.MANIFEST" "rundll32.exe" trying to access non-existent file "C:\MSOCF.dll.manifest" "rundll32.exe" trying to access non-existent file "C:\MSOCF.DLL.123.MANIFEST" "rundll32.exe" trying to access non-existent file "C:\MSOCF.DLL.124.MANIFEST" "rundll32.exe" trying to access non-existent file "C:\MSOCF.DLL.2.MANIFEST" "rundll32.exe" trying to access non-existent file "\Device\RasAcd" "rundll32.exe" trying to access non-existent file "C:\Windows\SysWOW64\RUNDLL32.EXE.LOCAL" "rundll32.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rundll32.exe.Local\" "rundll32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\EMBEDDEDDRIVERSERVICE.SYS" "rundll32.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\EmbeddedDriverService.sys" "rundll32.exe" trying to access non-existent file "STProcessMonitorDriver" "rundll32.exe" trying to access non-existent file "B:" "rundll32.exe" trying to access non-existent file "D:"6b:Te5a,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00007008-00000C2C-2827857762") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "MSOCF.dll") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "MSOCF.dll") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "MSOCF.dll") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "MSOCF.dll") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "MSOCF.dll") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "MSOCF.dll") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "MSOCF.dll") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "MSOCF.dll") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "MSOCF.dll") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "MSOCF.dll") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "MSOCF.dll") Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "MSOCF.dll") Found reference to API "WSASend" (Indicator: "WSASend"; File: "MSOCF.dll") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp")6c:T47a,Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")6d:T647,Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "MSOCF.dll") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "MSOCF.dll") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "MSOCF.dll") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "MSOCF.dll") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "MSOCF.dll") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "MSOCF.dll") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "MSOCF.dll") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "MSOCF.dll") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "MSOCF.dll") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "MSOCF.dll") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "MSOCF.dll") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "MSOCF.dll") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "MSOCF.dll") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "MSOCF.dll") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "MSOCF.dll") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; File: "MSOCF.dll")6e:T8b4,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")6f:Tadf,Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "u.qqt/qqsj0ppsssu" Pattern match: "5.xfk/nnp7" Pattern match: "vhp.yxvhp.vhp/d$hpt$,sd$`pd$tpd$th!d$" Pattern match: "qsvwy.qh/svwjf92untwrpqjq3bhhut=9uqjn3ytqh_^[]j7hhuu$shqj93qj" Pattern match: "pjvw-pjww.pjrw/pjswhpjpwlpjqw" Pattern match: "relocext-ms-win-shell32-shellfolders-l1-1-0.dllext-ms-win-ntuser-synch-l1-1-0.dllext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll/helpevtopenchannelconfigevtgetchannelconfigpropertyevtsetchannelconfigpropertyevtsavechannelconfigwininetproxyregistrymutexlocal" Pattern match: "mode.rich/.text`.data.idata@.didat.rsrc@.relocinitializeconditionvariablesleepconditionvariablecswakeallconditionvariabletwinapi.appcore.dllapi-ms-win-core-com-l1-1-0.dllapi-ms-win-security-sddl-l1-1-0.dlluserenv.dlloleaut32.dllapi-ms-win-core-com-l1-1-1.d" Pattern match: "uq2ah5.bu/49" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f" Pattern match: "http://schemas.microsoft.com/windows/2005/03/printing/bidi" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j" Pattern match: "canonicalizer.ucsuri.tcs/68007400740070003a002f002f00httphttpsrsdscanonurl.pdbgctl.rdata$brc.crt$xca.crt$xcu.crt$xcz.crt$xia.crt$xic.crt$xiz.crt$xpa.crt$xpz.crt$xta.crt$xtz.gfids.rdata.rdata$sxdata.rdata$zzzdbg.rtc$iaa.rtc$izz.rtc$taa.rtc$tzz.text$di.text$" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0u~d_nlik'lwashington1redmond1microsoft" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i~^;{m" Pattern match: "http://schemas.microsoft.com/appx/2013/appxprovisionpackage" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "https://www.microsoft.com/en-us/windows" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Heuristic match: "hs.sl"70:T4c2e,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000008.00000000.246917.00690000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000400.00000000.244980.00920000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000400.00000001.246589.00920000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001312.00000000.244981.00920000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001312.00000001.246586.00920000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003928.00000000.246917.00B00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004044.00000000.244979.00F00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004656.00000000.246912.03110000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00004656.00000000.246912.05470000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00004656.00000000.246912.05470000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00004656.00000000.246912.05470000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004656.00000000.246912.05470000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004656.00000000.246912.05470000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004656.00000000.246912.05470000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00005276.00000000.246914.050E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00005276.00000000.246914.050E0000.00000004.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00005276.00000000.246914.050E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005276.00000000.246914.050E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00005276.00000000.246914.050E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005276.00000000.246914.050E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00005276.00000000.246914.05220000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00005276.00000000.246914.05220000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00005276.00000000.246914.05220000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00005276.00000000.246914.05220000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00005276.00000000.246914.05220000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00005276.00000000.246914.05220000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007008.00000000.244979.005C0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007008.00000001.246585.005C0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0u0s0qehttp://www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt00?i" - Source: "00000000-00007008.00000001.246585.04BB0000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0i+w" - Source: "00000000-00007008.00000001.246585.04BB0000.00000040.mdmp") Found URL "https://www.microsoft.com/en-us/windows" - Source: "00000000-00007008.00000001.246585.04BB0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00007008.00000001.246585.04BB0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0=o'x_hl$z_" - Source: "00000000-00007008.00000001.246585.04BB0000.00000040.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00007008.00000001.246585.04BB0000.00000040.mdmp")71:T524,YARA signature for encryption algorithm file "advapi32.dll" YARA signature for encryption algorithm process "00000000-00003928" YARA signature for encryption algorithm process "00000000-00004656" YARA signature for encryption algorithm file "certcli.dll" YARA signature for encryption algorithm process "00000000-00001312" YARA signature for encryption algorithm file "appidapi.dll" YARA signature for encryption algorithm file "AudioSes.dll" YARA signature for encryption algorithm process "00000000-00005276" YARA signature for encryption algorithm file "AppXDeploymentClient.dll" YARA signature for encryption algorithm process "00000000-00000400" YARA signature for encryption algorithm process "00000000-00004044" YARA signature for encryption algorithm file "AzureSettingSyncProvider.dll" YARA signature for encryption algorithm process "00000000-00007008" YARA signature for encryption algorithm file "AppxAllUserStore.dll" YARA signature for encryption algorithm file "AppxPackaging.dll" YARA signature for encryption algorithm file "aepic.dll" YARA signature for encryption algorithm process "00000000-00000008" YARA signature for encryption algorithm file "bcrypt.dll" YARA signature for encryption algorithm file "BthTelemetry.dll" YARA signature for encryption algorithm file "cdp.dll"72:Tfee,Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "MSOCF.dll") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "MSOCF.dll") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp")73:T512,Found string "GetLogicalDriveStringsW" (Indicator: "getlogicaldrivestringsw"; Source: "00000000-00007008-00000C2C-2853775544") Found string "GetLogicalDriveStringsW" (Indicator: "getlogicaldrivestringsw"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "GetLogicalDriveStringsW" (Indicator: "getlogicaldrivestringsw"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "GetLogicalDriveStringsW" (Indicator: "getlogicaldrivestringsw"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found string "GetLogicalDriveStringsW" (Indicator: "getlogicaldrivestringsw"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found string "GetLogicalDriveStringsW" (Indicator: "getlogicaldrivestringsw"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found string "GetLogicalDriveStringsW" (Indicator: "getlogicaldrivestringsw"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")74:T504,Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "5,,RtlGetNtProductType,NTDLL.dll,"01:03:48.2" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004044.00000001.246587.00F00000.00000004.mdmp"), Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp 00000000-00004044.00000001.246587.057F0000.00000040.mdmp"), Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp 00000000-00004656.00000000.246912.05470000.00000040.mdmp 00000000-00004656.00000000.246912.05580000.00000040.mdmp")75:Tac8,Found registry query API: "RegGetValueW" in file "MSOCF.dll" Found registry query API: "RegQueryInfoKeyA" in file "MSOCF.dll" Found registry query API: "RegEnumKeyExA" in file "MSOCF.dll" Found registry query API: "RegGetValueA" in file "MSOCF.dll" Found registry query API: "SHGetValueW" in file "MSOCF.dll" Found registry query API: "RegQueryValueExA" in file "MSOCF.dll" Found registry query API: "NtQueryValueKey" in file "MSOCF.dll" Found registry query API: "RegSaveKeyExW" in file "MSOCF.dll" Found registry query API: "RegOpenKeyW" in file "MSOCF.dll" Found registry query API: "NtQueryKey" in file "MSOCF.dll" Found registry query API: "NtEnumerateValueKey" in file "MSOCF.dll" Found registry query API: "NtEnumerateKey" in file "MSOCF.dll" Found registry query API: "RegNotifyChangeKeyValue" in file "MSOCF.dll" Found registry query API: "ZwQueryValueKey" in file "MSOCF.dll" Found registry query API: "ZwEnumerateKey" in file "MSOCF.dll" Found registry query API: "RtlQueryRegistryValuesEx" in file "MSOCF.dll" Found registry query API: "RegEnumValueA" in file "MSOCF.dll" Found registry query API: "RegQueryValueExW" in "00000000-00000008.00000000.246917.044C0000.00000040.mdmp, 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000008.00000000.246917.044C0000.00000040.mdmp, 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00000400.00000000.244980.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.043E0000.00000040.mdmp, 00000000-00000400.00000001.246589.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000400.00000000.244980.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.043E0000.00000040.mdmp, 00000000-00000400.00000001.246589.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp"76:T9cf,Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "MSOCF.dll") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; File: "MSOCF.dll") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStrings"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")77:T819,"rundll32.exe" called "GetDriveTypeW" with parameter B:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter D:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter E:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter F:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter G:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter H:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter I:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter J:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter K:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter L:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter M:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter N:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter O:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter P:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter Q:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter R:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter S:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter T:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter U:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter V:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter W:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter X:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter Y:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00004044)78:Tad6,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "MSOCF.dll") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "MSOCF.dll") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "MSOCF.dll") Found reference to API "FindFirstFileNameW" (Indicator: "FindFirstFile"; File: "MSOCF.dll") Found reference to API "FindNextFileNameW" (Indicator: "FindNextFile"; File: "MSOCF.dll") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "MSOCF.dll") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")79:T42a,Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00000008.00000000.246917.044C0000.00000040.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00000400.00000000.244980.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.043E0000.00000040.mdmp, 00000000-00000400.00000001.246589.04470000.00000040.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00001312.00000001.246586.043E0000.00000040.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00003928.00000000.246917.04580000.00000040.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00004044.00000000.244979.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.04F10000.00000040.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00004656.00000000.246912.04C10000.00000040.mdmp")7a:T468,Found reference to API "QueryDosDeviceW" (Indicator: "QueryDosDevice"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "QueryDosDeviceW" (Indicator: "QueryDosDevice"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "QueryDosDeviceW" (Indicator: "QueryDosDevice"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "QueryDosDeviceW" (Indicator: "QueryDosDevice"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "QueryDosDeviceW" (Indicator: "QueryDosDevice"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "QueryDosDeviceW" (Indicator: "QueryDosDevice"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")7b:T4a4,Found reference to API "GetCurrentHwProfileW" (Indicator: "GetCurrentHwProfile"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetCurrentHwProfileW" (Indicator: "GetCurrentHwProfile"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetCurrentHwProfileW" (Indicator: "GetCurrentHwProfile"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetCurrentHwProfileW" (Indicator: "GetCurrentHwProfile"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetCurrentHwProfileW" (Indicator: "GetCurrentHwProfile"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetCurrentHwProfileW" (Indicator: "GetCurrentHwProfile"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")7c:T44a,Found reference to API "GetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetProcessId" (Indicator: "GetProcessId"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")7d:T4de,Found reference to API "GetSystemMetricsForDpi" (Indicator: "GetSystemMetrics"; File: "MSOCF.dll") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")7e:Tb06,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp 00000000-00004656.00000000.246912.05470000.00000040.mdmp 00000000-00004656.00000000.246912.05580000.00000040.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp 00000000-00004656.00000000.246912.05470000.00000040.mdmp 00000000-00004656.00000000.246912.05580000.00000040.mdmp7f:Tee5,Found string "[esc]" (Indicator: "[esc]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[tab]" (Indicator: "[tab]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[F7]" (Indicator: "[F7]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[F8]" (Indicator: "[F8]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[F9]" (Indicator: "[F9]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[F10]" (Indicator: "[F10]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[numlock]" (Indicator: "[NumLock]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[scrolllock]" (Indicator: "[ScrollLock]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[F11]" (Indicator: "[F11]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[F12]" (Indicator: "[F12]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[home]" (Indicator: "[home]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[end]" (Indicator: "[end]"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[esc]" (Indicator: "[esc]"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "[tab]" (Indicator: "[tab]"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp")80:Td1e,Found string "[-] Could not unload. Try manually: sc stop" (Indicator: "sc stop"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[!] Run manually: sc delete" (Indicator: "sc delete"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[OK] Use: sc query" (Indicator: "sc query"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "[-] Could not unload. Try manually: sc stop" (Indicator: "sc stop"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "[!] Run manually: sc delete" (Indicator: "sc delete"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "[OK] Use: sc query" (Indicator: "sc query"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "[-] Could not unload. Try manually: sc stop" (Indicator: "sc stop"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found string "[!] Run manually: sc delete" (Indicator: "sc delete"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found string "[OK] Use: sc query" (Indicator: "sc query"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found string "[-] Could not unload. Try manually: sc stop" (Indicator: "sc stop"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found string "[!] Run manually: sc delete" (Indicator: "sc delete"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found string "[OK] Use: sc query" (Indicator: "sc query"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found string "[-] Could not unload. Try manually: sc stop" (Indicator: "sc stop"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found string "[!] Run manually: sc delete" (Indicator: "sc delete"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found string "[OK] Use: sc query" (Indicator: "sc query"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found string "[-] Could not unload. Try manually: sc stop" (Indicator: "sc stop"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found string "[!] Run manually: sc delete" (Indicator: "sc delete"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found string "[OK] Use: sc query" (Indicator: "sc query"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")81:T558,Found string "SELECT displayName FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00003928-00002714-2863972387") Found string "SELECT displayName FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "SELECT displayName FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "SELECT displayName FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found string "SELECT displayName FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found string "SELECT displayName FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found string "SELECT displayName FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")82:Tb88,Found registry deletion API: "RegDeleteTreeW" in file "MSOCF.dll" Found registry deletion API: "SHDeleteKeyW" in file "MSOCF.dll" Found registry deletion API: "RegDeleteKeyW" in file "MSOCF.dll" Found registry deletion API: "NtDeleteKey" in file "MSOCF.dll" Found registry deletion API: "NtDeleteValueKey" in file "MSOCF.dll" Found registry deletion API: "RegDeleteKeyValueW" in file "MSOCF.dll" Found registry deletion API: "RegDeleteKeyExW" in file "MSOCF.dll" Found registry deletion API: "RegDeleteValueA" in file "MSOCF.dll" Found registry deletion API: "RegDeleteValueW" in "00000000-00000008.00000000.246917.044C0000.00000040.mdmp, 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp" Found registry deletion API: "RegDeleteTreeA" in "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00000400.00000000.244980.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.043E0000.00000040.mdmp, 00000000-00000400.00000001.246589.04470000.00000040.mdmp, 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp" Found registry deletion API: "RegDeleteTreeA" in "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00001312.00000001.246586.043E0000.00000040.mdmp, 00000000-00001312.00000001.246586.04E20000.00000040.mdmp" Found registry deletion API: "RegDeleteTreeA" in "00000000-00001312.00000001.246586.04E20000.00000040.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00003928.00000000.246917.04580000.00000040.mdmp, 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp" Found registry deletion API: "RegDeleteTreeA" in "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00004044.00000000.244979.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.04F10000.00000040.mdmp, 00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp" Found registry deletion API: "RegDeleteTreeA" in "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00004656.00000000.246912.04C10000.00000040.mdmp, 00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp" Found registry deletion API: "RegDeleteTreeA" in "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp"83:T4d4,Observed import api "OpenProcess" which can be "used to open a process handle" [Source: accessibilitycpl.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: cdp.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: AcGenral.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: cmiv2.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: AppVEntSubsystems32.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: aadtb.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: cdprt.dll] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: bcastdvr.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: autochk.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: autoconv.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: autofmt.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: azroles.dll]84:T11b3,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000008.00000000.246917.00690000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000008.00000000.246917.00690000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00000008.00000000.246917.00690000.00000004.mdmp") Found string "\Device\STProcessMonitorDriver" (Indicator: "\Device\"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000400.00000000.244980.00920000.00000004.mdmp, 00000000-00000400.00000001.246589.00920000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000400.00000000.244980.00920000.00000004.mdmp, 00000000-00000400.00000001.246589.00920000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00000400.00000000.244980.00920000.00000004.mdmp, 00000000-00000400.00000001.246589.00920000.00000004.mdmp") Found string "\Device\STProcessMonitorDriver" (Indicator: "\Device\"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001312.00000000.244981.00920000.00000004.mdmp, 00000000-00001312.00000001.246586.00920000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001312.00000000.244981.00920000.00000004.mdmp, 00000000-00001312.00000001.246586.00920000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00001312.00000000.244981.00920000.00000004.mdmp, 00000000-00001312.00000001.246586.00920000.00000004.mdmp") Found string "\Device\STProcessMonitorDriver" (Indicator: "\Device\"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003928.00000000.246917.00B00000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003928.00000000.246917.00B00000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00003928.00000000.246917.00B00000.00000004.mdmp") Found string "\Device\STProcessMonitorDriver" (Indicator: "\Device\"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004044.00000000.244979.00F00000.00000004.mdmp, 00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004044.00000000.244979.00F00000.00000004.mdmp, 00000000-00004044.00000001.246587.00F00000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00004044.00000000.244979.00F00000.00000004.mdmp") Found string "\Device\STProcessMonitorDriver" (Indicator: "\Device\"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004656.00000000.246912.03110000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004656.00000000.246912.03110000.00000004.mdmp") Found string "\Device\STProcessMonitorDriver" (Indicator: "\Device\"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005276.00000000.246914.00AC0000.00000004.mdmp")85:T499,Found reference to API "CoGetObjectContext" (Indicator: "CoGetObject"; File: "MSOCF.dll") Found reference to API "CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "CoGetObject" (Indicator: "CoGetObject"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")86:T462,Found reference to API "IoDeleteDevice" (Indicator: "IoDeleteDevice"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "IoDeleteDevice" (Indicator: "IoDeleteDevice"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "IoDeleteDevice" (Indicator: "IoDeleteDevice"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "IoDeleteDevice" (Indicator: "IoDeleteDevice"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "IoDeleteDevice" (Indicator: "IoDeleteDevice"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "IoDeleteDevice" (Indicator: "IoDeleteDevice"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")87:T4e8,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "MSOCF.dll") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "MSOCF.dll") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")88:Tdd2,Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")89:T116d,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "MSOCF.dll") Found reference to API "CheckTokenMembershipEx" (Indicator: "CheckTokenMembership"; File: "MSOCF.dll") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00001312.00000001.246586.00920000.00000004.mdmp, 00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp")8a:T14a6,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "MSOCF.dll") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "MSOCF.dll") Found reference to API "NtSetInformationFile" (Indicator: "SetInformationFile"; File: "MSOCF.dll") Found reference to API "NtSetInformationFile" (Indicator: "NtSetInformationFile"; File: "MSOCF.dll") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "SetInformationFile"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "ZwSetInformationFile"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "SetInformationFile"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "ZwSetInformationFile"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "SetInformationFile"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "ZwSetInformationFile"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "SetInformationFile"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "ZwSetInformationFile"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "SetInformationFile"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "ZwSetInformationFile"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "SetInformationFile"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "ZwSetInformationFile(%wZ): 0x%x" (Indicator: "ZwSetInformationFile"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "SetInformationFile"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp") Found reference to API "ZwSetInformationFile" (Indicator: "ZwSetInformationFile"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")8b:Ta74,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "MSOCF.dll") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "MSOCF.dll") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "MSOCF.dll") Found reference to API "CoRevertToSelf" (Indicator: "RevertToSelf"; File: "MSOCF.dll") Found reference to API "CopySid" (Indicator: "CopySid"; File: "MSOCF.dll") Found reference to API "AccessCheckByType" (Indicator: "AccessCheck"; File: "MSOCF.dll") Found reference to API "AccessCheckByType" (Indicator: "AccessCheckByType"; File: "MSOCF.dll") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "MSOCF.dll") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "MSOCF.dll") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "MSOCF.dll") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "MSOCF.dll") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "MSOCF.dll") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "MSOCF.dll") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "MSOCF.dll") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "MSOCF.dll") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "MSOCF.dll") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "MSOCF.dll") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; File: "MSOCF.dll") Found reference to API "GetAce" (Indicator: "GetAce"; File: "MSOCF.dll") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "MSOCF.dll") Found reference to API "RtlEqualSid" (Indicator: "EqualSid"; File: "MSOCF.dll") Found reference to API "RtlInitializeSid" (Indicator: "InitializeSid"; File: "MSOCF.dll") Found reference to API "SetSecurityDescriptorControl" (Indicator: "SetSecurityDescriptorControl"; File: "MSOCF.dll") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "MSOCF.dll") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "MSOCF.dll") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "MSOCF.dll") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "MSOCF.dll") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "MSOCF.dll")8c:T4557,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: accessibilitycpl.dll] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: accessibilitycpl.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: accessibilitycpl.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: accessibilitycpl.dll] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: cdp.dll] Observed import api "AccessCheck" which can "determine whether a security descriptor grants a specified set of access rights to the client identified by an access token" [Source: cdp.dll] Observed import api "AccessCheckByType" which can "determine whether a security descriptor grants a specified set of access rights to the client identified by an access token" [Source: cdp.dll] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: cdp.dll] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: cdp.dll] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: cdp.dll] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: cdp.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: cdp.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: cdp.dll] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: cdp.dll] Observed import api "CheckTokenMembershipEx" which can "determine whether the specified SID is enabled in the specified token" [Source: cdp.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: AcGenral.dll] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: AcGenral.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: AcGenral.dll] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: AcGenral.dll] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: AcGenral.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: AcGenral.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: AcGenral.dll] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: AcGenral.dll] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: AcGenral.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: AcGenral.dll] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: AcGenral.dll] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: AcGenral.dll] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: AcGenral.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: AcGenral.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: AcGenral.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: AcGenral.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: AcGenral.dll] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: cmiv2.dll] Observed import api "SetSecurityDescriptorControl" which can "set the control bits of a security descriptor" [Source: cmiv2.dll] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: AppVEntSubsystems32.dll] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: AppVEntSubsystems32.dll] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: AppVEntSubsystems32.dll] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: AppVEntSubsystems32.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: AppVEntSubsystems32.dll] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: AppVEntSubsystems32.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: AppVEntSubsystems32.dll] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: AppVEntSubsystems32.dll] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: AppVEntSubsystems32.dll] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: AppVEntSubsystems32.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: AppVEntSubsystems32.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: AppVEntSubsystems32.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: AppVEntSubsystems32.dll] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: AppVEntSubsystems32.dll] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: AppVEntSubsystems32.dll] Observed import api "MakeSelfRelativeSD" which can "create a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: AppVEntSubsystems32.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: AppVEntSubsystems32.dll] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: AppVEntSubsystems32.dll] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: AppVEntSubsystems32.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: AppxPackaging.dll] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: AppxPackaging.dll] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: AppxPackaging.dll] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: AppxPackaging.dll] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: AppxPackaging.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: AppxPackaging.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: AppxPackaging.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: AppxPackaging.dll] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: aadtb.dll] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: aadtb.dll] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: aadtb.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: aadtb.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: aadtb.dll] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: cdprt.dll] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: cdprt.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: cdprt.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: bcastdvr.exe] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: bcastdvr.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: autochk.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: autochk.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: autochk.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: autochk.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: autoconv.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: autoconv.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: autoconv.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: autoconv.exe] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: cdosys.dll] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: cdosys.dll] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: autofmt.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: autofmt.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: autofmt.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: autofmt.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: azroles.dll] Observed import api "AddAccessAllowedAceEx" which can "add an access-allowed access control entry (ACE) to the end of a discretionary access control list (DACL)" [Source: azroles.dll] Observed import api "AddAccessAllowedObjectAce" which can "add an access-allowed access control entry (ACE) to the end of a discretionary access control list (DACL)" [Source: azroles.dll] Observed import api "AddAuditAccessAce" which can "add a system-audit access control entry (ACE) to a system access control list (ACL)" [Source: azroles.dll] Observed import api "AddAuditAccessAceEx" which can "add a system-audit access control entry (ACE) to the end of a system access control list (SACL)" [Source: azroles.dll] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: azroles.dll] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: azroles.dll] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: azroles.dll] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: azroles.dll] Observed import api "EqualDomainSid" which can "determine whether two SIDs are from the same domain" [Source: azroles.dll] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: azroles.dll] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: azroles.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: azroles.dll] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: azroles.dll] Observed import api "GetSecurityDescriptorLength" which can "return the length in bytes of a structurally valid security descriptor" [Source: azroles.dll] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: azroles.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: azroles.dll] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: azroles.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: azroles.dll] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: azroles.dll] Observed import api "MakeSelfRelativeSD" which can "create a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: azroles.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: azroles.dll] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: azroles.dll] Observed import api "SetSecurityDescriptorSacl" which can "set information in a system access control list (SACL)" [Source: azroles.dll] Observed import api "AccessCheck" which can "determine whether a security descriptor grants a specified set of access rights to the client identified by an access token" [Source: azroles.dll] Observed import api "AllocateLocallyUniqueId" which can "allocate a locally unique identifier (LUID)" [Source: azroles.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: azroles.dll]8d:T9ba,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")8e:T4a6,Found reference to API "NtShutdownSystem" (Indicator: "ShutdownSystem"; File: "MSOCF.dll") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "ExitWindowsEx" (Indicator: "ExitWindows"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")8f:T651,Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; File: "MSOCF.dll") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "MSOCF.dll") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; File: "MSOCF.dll") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00000400.00000001.246589.04ED0000.00000040.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00001312.00000001.246586.04E20000.00000040.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00004044.00000000.244979.00EB9000.00000002.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00004044.00000000.244979.00EB9000.00000002.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; Source: "00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp")90:T58b,"MSOCF.dll" was detected as "Borland Delphi 3.0 (???)" "accessibilitycpl.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "cdp.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "AcGenral.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "cmiv2.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "batmeter.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "ActiveSyncProvider.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "AppVEntSubsystems32.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "AppxPackaging.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "AzureSettingSyncProvider.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "AudioEng.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "AudioSes.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "aadtb.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "cdprt.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "bcastdvr.exe" was detected as "VC8 -> Microsoft Corporation" "autochk.exe" was detected as "Visual C++ 2003 DLL -> Microsoft" "autoconv.exe" was detected as "Visual C++ 2003 DLL -> Microsoft" "cdosys.dll" was detected as "Visual C++ 2005 DLL -> Microsoft" "adtschema.dll" was detected as "Microsoft Visual C++ vx.x DLL" "autofmt.exe" was detected as "Visual C++ 2003 DLL -> Microsoft" "azroles.dll" was detected as "Visual C++ 2005 DLL -> Microsoft"91:T50f,"MSOCF.dll" has resource with unusual entropy "RT_ICON:7.9664358846760095" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.903437749511489" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.975854547211234" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.970776886564805" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.977974520644237" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.965957737466065" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.970386719868462" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.9756748869194505" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.976302122138195" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.985062294225375" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.9741880126239035" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.553457005565576" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.986457254075343" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.969381675862415" "accessibilitycpl.dll" has resource with unusual entropy "RT_ICON:7.953672771388162"92:T5532,"BingMaps.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "aclui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AuthFWSnapin.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "accessibilitycpl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "cdp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcGenral.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "cmiv2.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "batmeter.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActiveSyncProvider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppVEntSubsystems32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "AppxPackaging.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AzureSettingSyncProvider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AudioEng.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "AudioSes.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "aadtb.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "cdprt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "bcastdvr.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- [targetUID: N/A] "autochk.exe" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"- [targetUID: N/A] "autoconv.exe" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"- [targetUID: N/A] "cdosys.dll" has type "PE32 executable for MS Windows 6.01 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adtschema.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "autofmt.exe" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections"- [targetUID: N/A] "azroles.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BingOnlineServices.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "appwiz.cpl" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppointmentApis.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "certca.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "apphelp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00000400] "AppxApplicabilityEngine.dll" has type "PE32 executable for MS Windows 6.01 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppContracts.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppXDeploymentClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActionCenterCPL.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcSpecfc.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "advapi32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: 00000000-00000400] "authui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AdmTmpl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "ActivationManager.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppResolver.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "certCredProvider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BcastDVRBroker.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "catsrvut.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "catsrv.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AUDIOKSE.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 10 sections"- [targetUID: N/A] "AcLayers.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: 00000000-00000400] "appmgr.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AccountsRt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "bcryptprimitives.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00000400] "authfwcfg.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "certcli.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "azroleui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BCP47Langs.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "atmfd.dll" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 6 sections"- [targetUID: N/A] "AuthFWGP.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adsnt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppIdPolicyEngineApi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "biwinrt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "capauthz.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "actxprxy.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "ActionCenter.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BcastDVRClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AboveLockAppHost.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BioCredProv.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "audiodev.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppLockerCSP.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "activeds.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "bthprops.cpl" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AuditNativeSnapIn.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "accountaccessor.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "apds.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "aepic.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adsldpc.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "cemapi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "87JH27UD.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adsldp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppxAllUserStore.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "authz.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "basecsp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "bitsadmin.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 6 sections"- [targetUID: N/A] "AuthBroker.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BcastDVRCommon.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "appmgmts.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "altspace.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "AppxSip.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "aadauthhelper.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "cabview.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "autoplay.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "bcastdvr.proxy.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AppExtension.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BluetoothApis.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "CastingShellExt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppManagementConfiguration.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "CallHistoryClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BrowserSettingSync.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppointmentActivation.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "advpack.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "cabinet.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "btpanui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BitLockerCsp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AuthFWWizFwk.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "bcd.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "avifil32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adrclient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "bcrypt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: 00000000-00000400] "auditpolmsg.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "AuthBrokerUI.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "msimsg.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "CameraCaptureUI.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "adsmsext.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AcXtrnal.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "AppCapture.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "atl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "bootcfg.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "amstream.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "CallButtons.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "asycfilt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "cca.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "avicap32.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: 00000000-00004044] "acppage.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "CapabilityAccessManagerClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "comdlg32.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "ApiSetHost.AppExecutionAlias.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "BackgroundMediaPolicy.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AuditPolicyGPInterop.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "cabapi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "auditpolcore.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AuthExt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "capiprovider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "bidispl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BWContextHandler.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AddressParser.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "appidapi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "amsi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "adprovider.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AtBroker.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "APHostClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "admwprox.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "ByteCodeGenerator.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "cdosys.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "windows.ui.xaml.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "BitsProxy.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "browcli.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "atmlib.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "acwow64.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AdaptiveCards.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "bthudtask.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 6 sections"- [targetUID: N/A] "atlthunk.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BackgroundTransferHost.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "AcWinRT.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "SyncRes.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "CameraSettingsUIHost.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- [targetUID: N/A] "Apphlpdm.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "aeevts.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "ActivationClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 6 sections"- [targetUID: N/A] "aspnet_counters.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "auditpol.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "BthTelemetry.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 7 sections"- [targetUID: N/A] "canonurl.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "cacls.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "avrt.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AppVClientPS.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "ahadmin.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "calc.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "aspperf.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AzSqlExt.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "at.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "catsrvps.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "bitsperf.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "appidtel.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "capisp.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "AnalogCommonProxyStub.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "attrib.exe" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "CallButtons.ProxyStub.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "backgroundTaskHost.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "AppVTerminator.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "mlang.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "fms.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "AppVSentinel.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "BamSettingsClient.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "browseui.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "apprepapi.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "acledit.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "comctl32.dll.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "quickassist.exe.mui" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "asferror.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "advapi32res.dll" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "activeds.tlb" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "bdaplgin.ax" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "EmbeddedDriverService.sys" has type "PE32+ executable for MS Windows 10.00 (native) x86-64 8 sections"- Location: [%TEMP%\EmbeddedDriverService.sys]- [targetUID: 00000000-00000400] "cero.rs" has type "PE32 executable for MS Windows 10.00 (DLL) Intel i386 2 sections"- [targetUID: N/A] "BOOTVID.DLL" has type "PE32 executable for MS Windows 10.00 (native) Intel i386 7 sections"- [targetUID: N/A] "ARP.EXE" has type "PE32 executable for MS Windows 10.00 (console) Intel i386 5 sections"- [targetUID: N/A] "amcompat.tlb" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"- [targetUID: N/A]93:T819,"rundll32.exe" called "GetDriveTypeW" with parameter B:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter C:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter D:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter E:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter F:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter G:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter H:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter I:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter J:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter K:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter L:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter M:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter N:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter O:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter P:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter Q:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter R:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter S:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter T:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter U:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter V:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter W:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter X:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter Y:\ (UID: 00000000-00004044) "rundll32.exe" called "GetDriveTypeW" with parameter Z:\ (UID: 00000000-00004044)94:T588,"Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" is a hint for the "CLSID of CMSTPLUA Com object" in Source: 00000000-00000008.00000000.246917.04BF0000.00000004.mdmp 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp "Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" is a hint for the "CLSID of CMSTPLUA Com object" in Source: 00000000-00000400.00000001.246589.04ED0000.00000040.mdmp "Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" is a hint for the "CLSID of CMSTPLUA Com object" in Source: 00000000-00001312.00000001.246586.04E20000.00000040.mdmp "Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" is a hint for the "CLSID of CMSTPLUA Com object" in Source: 00000000-00003928.00000000.246917.04DB0000.00000004.mdmp 00000000-00003928.00000000.246917.04F90000.00000040.mdmp "Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" is a hint for the "CLSID of CMSTPLUA Com object" in Source: 00000000-00004044.00000001.246587.05650000.00000004.mdmp 00000000-00004044.00000001.246587.057F0000.00000040.mdmp "Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" is a hint for the "CLSID of CMSTPLUA Com object" in Source: 00000000-00004656.00000000.246912.05370000.00000004.mdmp 00000000-00004656.00000000.246912.05470000.00000040.mdmp 00000000-00004656.00000000.246912.05580000.00000040.mdmp95:T59c,"MSOCF.dll" claimed CRC 126024 while the actual is CRC 145794 "accessibilitycpl.dll" claimed CRC 5162289 while the actual is CRC 3850339 "cdp.dll" claimed CRC 3850339 while the actual is CRC 3225122 "AcGenral.dll" claimed CRC 3225122 while the actual is CRC 2417448 "cmiv2.dll" claimed CRC 2417448 while the actual is CRC 2098028 "batmeter.dll" claimed CRC 2098028 while the actual is CRC 1726777 "ActiveSyncProvider.dll" claimed CRC 1726777 while the actual is CRC 1554521 "AppVEntSubsystems32.dll" claimed CRC 1554521 while the actual is CRC 1522308 "AppxPackaging.dll" claimed CRC 1522308 while the actual is CRC 1313375 "AzureSettingSyncProvider.dll" claimed CRC 1313375 while the actual is CRC 1327570 "AudioEng.dll" claimed CRC 1327570 while the actual is CRC 1292514 "AudioSes.dll" claimed CRC 1292514 while the actual is CRC 1020559 "aadtb.dll" claimed CRC 1020559 while the actual is CRC 978596 "cdprt.dll" claimed CRC 978596 while the actual is CRC 992959 "bcastdvr.exe" claimed CRC 992959 while the actual is CRC 914059 "autochk.exe" claimed CRC 914059 while the actual is CRC 880836 "autoconv.exe" claimed CRC 880836 while the actual is CRC 886967 "cdosys.dll" claimed CRC 886967 while the actual is CRC 875053 "adtschema.dll" claimed CRC 875053 while the actual is CRC 871876 "autofmt.exe" claimed CRC 871876 while the actual is CRC 867458 "azroles.dll" claimed CRC 867458 while the actual is CRC 82423396:T647,Sleep WriteFile GetModuleHandleW GetModuleHandleExW IsDebuggerPresent GetProcAddress LoadLibraryExW GetTempPathW GetModuleFileNameA GetModuleFileNameW CreateFileW GetStartupInfoW GetCommandLineA TerminateProcess GetModuleHandleA UnhandledExceptionFilter VirtualAlloc OutputDebugStringW DeleteFileW GetFileAttributesW CreateProcessW OpenProcess RegEnumKeyExW ShellExecuteExW ShellExecuteW GetWindowThreadProcessId FindResourceExW LockResource LoadLibraryW RegDeleteValueW RegCreateKeyExW RegOpenKeyExW RegCloseKey GetTickCount CertDeleteCertificateFromStore WSASendTo socket listen WSAStartup bind closesocket WSASocketW WSASend FindFirstFileW CreateDirectoryW FindNextFileW GetFileAttributesA CreateFileA CreateDirectoryA GetFileSize OpenProcessToken RegEnumKeyExA RegOpenKeyExA GetComputerNameExW GetTickCount64 GetVersionExW GetUserNameW CreateThreadpool CreateThreadpoolTimer NtQueryInformationToken CreateFileMappingW GetSystemDirectoryA GetDriveTypeW FindResourceA DeviceIoControl FindResourceW LoadLibraryA GetTempPathA WriteProcessMemory GetLogicalDrives VirtualProtect CopyFileW CopyFileA FindNextFileA GetTempFileNameW GetSystemInfo CreateThread CreateToolhelp32Snapshot DeleteFileA CreateProcessA MapViewOfFile GetTempFileNameA OutputDebugStringA CreateFileMappingA ReadProcessMemory GetCommandLineW VirtualAllocEx GetSystemDirectoryW GetDriveTypeA ShellExecuteExA GetUserNameExW SetWindowsHookExA GetUpdateRgn EnumPrintersA SetSecurityDescriptorDacl StartServiceW CreateServiceW ChangeServiceConfigW97:T45c,"AuthFWSnapin.dll" claims program is from Fri Dec 7 14:59:21 2057 "accessibilitycpl.dll" claims program is from Tue Aug 7 19:36:59 2035 "cdp.dll" claims program is from Sat Oct 25 01:00:37 2104 "AcGenral.dll" claims program is from Fri May 19 08:40:06 2102 "cmiv2.dll" claims program is from Thu Jan 4 16:58:21 1996 "AppVEntSubsystems32.dll" claims program is from Sun Jun 2 09:01:48 1996 "AppxPackaging.dll" claims program is from Mon Apr 14 06:51:56 2036 "AzureSettingSyncProvider.dll" claims program is from Wed Apr 19 10:42:29 2079 "AudioEng.dll" claims program is from Tue Jan 9 01:17:41 1990 "AudioSes.dll" claims program is from Thu Dec 5 03:45:56 2080 "cdprt.dll" claims program is from Tue Mar 4 13:14:16 2064 "bcastdvr.exe" claims program is from Fri Feb 4 20:21:59 2056 "autochk.exe" claims program is from Mon Oct 15 16:58:02 2074 "autoconv.exe" claims program is from Thu Dec 8 09:41:24 2061 "cdosys.dll" claims program is from Mon Jun 26 22:40:02 1989 "adtschema.dll" claims program is from Mon May 31 12:41:32 1971 "azroles.dll" claims program is from Sat Dec 24 13:16:04 207298:T49f,"rundll32.exe" called "NtUnloadDriver" with parameters {"DriverServiceName": "920094000000000000fa5e0000000000" "$name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\EmbeddedDriverService" "$status": "ffffffffc0000034"} "rundll32.exe" called "NtUnloadDriver" with parameters {"DriverServiceName": "92009400000000001009950000000000" "$name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\EmbeddedDriverService" "$status": "ffffffffc0000034"} "rundll32.exe" called "NtUnloadDriver" with parameters {"DriverServiceName": "920094000000000000fa130300000000" "$name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\EmbeddedDriverService" "$status": "ffffffffc0000034"} "rundll32.exe" called "NtUnloadDriver" with parameters {"DriverServiceName": "920094000000000020faae0000000000" "$name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\EmbeddedDriverService" "$status": "ffffffffc0000034"} "rundll32.exe" called "NtUnloadDriver" with parameters {"DriverServiceName": "920094000000000000f76b0000000000" "$name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\EmbeddedDriverService" "$status": "ffffffffc0000034"}99:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC9a:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC9b:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC9c:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC9d:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC9e:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC9f:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCCa0:T5a4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEAklEQVR4Xu2W+VOaRxzG84+3E+8LxQsQEHhBIJOjbeqReBKYOtrxmNiYoKAgSWREoTUlraCoT/dZXAIvxsk6/a19Z77Dzgvs8/meuw8e/P/c8oRCIdCCwSAmJiYQCATg9wdg+P0wDAM+nw9erxcejxfjHg/c4+Nwud1wudxwOl3wiO9GR0dh3vebH4pfXV012WW9XZrtEtfX1wiHw8hkMhLq3hD0nIKVSgUXtAtlFzhXdl79LJ8rO5cQBCgWi0il0nC6XLDeB4Jhvw2gJs71HQCnp6coFArYTSTgGHPCarXqQTDnBJDitwFQvCbcDJDP53F8fIxsNovt7W3Y7Q49ABZcDeBr4a8TNgNYLJYGGxwe1gNgtUuAmvgd4S9/AeA6Jzw/yinLiWgUMDg0pAkgWk0BKOF05j1m5hZR/PwX8oU/8OPkDHYSybooVAFK9VYqizq6hHVQE4B9zlarF3f5Q3gRWZYQRugxZmMrsLmNBu8bAco1gAHroB4Ah0wVgBGohtwXfor4+xxmIr9gaXUDb1If4REgFE8dZJq9FwBnNwD9A5pdwAnH4bKT2IN93C/FJ+ej2PmQw7vMEd4eiOpOH+Knl4vwBB/DaQQlhNl7BWAZGNAD4HhlBJjnpZUNJA7z2P14IiBeyfDTns8uySj8tv8BkwtRTM8uNHmvAPr6+/UAOEYZARYbxWLrW3ibzsq1yjnXjMLUYkyKfyp+bvK+BmDRBODBwp4uik1nxOYsOIa9ClCteAWwuLIu1yf535vEFUBvn0UTwEWAK0zPLWAutoq9bAHJbF6GWqXg57lItRZSh3gZXcEPIl1m8SpABT29fXoAPFIZARaWOxCG8egZphZiohZORC0cy2KMi2J8LiC8AobtGN9N4Nf1TcxHYg0AnKbdvb16AGNOpwRga6kWMx49RVIUY2xtCy9eLYuWPII3/ESGnTXg9AXkb3zCuOa7s7OSBOjq0QRwjI2hIgDq+5rtuHSTb25OCA6n/XRGCq5u7WArmcHrxAGWN7flu79vADq7e/QA7A5HE0B8NynzfCJm+6c/ixKC4gw5Paf4kMMtbSO+L1LzBKtrm1WArm49AJvdDFD+YqXGSmfeGXZ6rgDW3+3J2piPRCVAR2eXJoDNLttHiZlFzcZwM+z0nOLRtdcNKWjv7NQDGLXZJIBZ6Gs2PTsvBRl2es71lHinANo6NAFGxD3umwCEAEWUUZR5r39HgNb2Dj2A4ZG7AEpNwncZAVra2vUAhoZH5ARTYjqCZpMArW16ALzD8Y/mze5j3OehNoC4w9VuxP+Cfd/SqgfAOxyvUbzJ8DLB85xHKk81Hiyc7RyvnHAcMuxzthqrnQXHnDPs9Jzi3z1s0QP4Tz3/AI2nAnKaFughAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790463034161,"unified_at":"2026-09-26T22:50:34.161Z","metadata":{"hashes":{"sha256":"ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","sha1":"9620ad472df59317e4c7ee4c007c0064194bc02e","md5":"245869b41ec410035f994240282e390c","sha512":"f3e7a2f2f11e685c5f14c8ee4664261faa10610a75ce60feafea41ca2f095b3cd6b6081edfb289f3091f55064d609317017368313b006d40aa7012bd27a585f2","ssdeep":"1536:xOO/K+x594lMgPjK/tgCDM4DR1I4lMzoF2CuUZqxdc7juEsWjcdNQvIeYoEtB1:z/YlPe/tTM+9ufk2Nk3YoEN","ssdeep_chunks":["1536:xOO/K+x","1536:OO/K+x5","1536:O/K+x59","1536:/K+x594","1536:K+x594l","1536:+x594lM","1536:x594lMg","1536:594lMgP","1536:94lMgPj","1536:4lMgPjK","1536:lMgPjK/","1536:MgPjK/t","1536:gPjK/tg","1536:PjK/tgC","1536:jK/tgCD","1536:K/tgCDM","1536:/tgCDM4","1536:tgCDM4D","1536:gCDM4DR","1536:CDM4DR1","1536:DM4DR1I","1536:M4DR1I4","1536:4DR1I4l","1536:DR1I4lM","1536:R1I4lMz","1536:1I4lMzo","1536:I4lMzoF","1536:4lMzoF2","1536:lMzoF2C","1536:MzoF2Cu","1536:zoF2CuU","1536:oF2CuUZ","1536:F2CuUZq","1536:2CuUZqx","1536:CuUZqxd","1536:uUZqxdc","1536:UZqxdc7","1536:Zqxdc7j","1536:qxdc7ju","1536:xdc7juE","1536:dc7juEs","1536:c7juEsW","1536:7juEsWj","1536:juEsWjc","1536:uEsWjcd","1536:EsWjcdN","1536:sWjcdNQ","1536:WjcdNQv","1536:jcdNQvI","1536:cdNQvIe","1536:dNQvIeY","1536:NQvIeYo","1536:QvIeYoE","1536:vIeYoEt","1536:IeYoEtB","1536:eYoEtB1","3072:xOO/K+x","3072:OO/K+x5","3072:O/K+x59","3072:/K+x594","3072:K+x594l","3072:+x594lM","3072:x594lMg","3072:594lMgP","3072:94lMgPj","3072:4lMgPjK","3072:lMgPjK/","3072:MgPjK/t","3072:gPjK/tg","3072:PjK/tgC","3072:jK/tgCD","3072:K/tgCDM","3072:/tgCDM4","3072:tgCDM4D","3072:gCDM4DR","3072:CDM4DR1","3072:DM4DR1I","3072:M4DR1I4","3072:4DR1I4l","3072:DR1I4lM","3072:R1I4lMz","3072:1I4lMzo","3072:I4lMzoF","3072:4lMzoF2","3072:lMzoF2C","3072:MzoF2Cu","3072:zoF2CuU","3072:oF2CuUZ","3072:F2CuUZq","3072:2CuUZqx","3072:CuUZqxd","3072:uUZqxdc","3072:UZqxdc7","3072:Zqxdc7j","3072:qxdc7ju","3072:xdc7juE","3072:dc7juEs","3072:c7juEsW","3072:7juEsWj","3072:juEsWjc","3072:uEsWjcd","3072:EsWjcdN","3072:sWjcdNQ","3072:WjcdNQv","3072:jcdNQvI","3072:cdNQvIe","3072:dNQvIeY","3072:NQvIeYo","3072:QvIeYoE","3072:vIeYoEt","3072:IeYoEtB","3072:eYoEtB1","1536:z/YlPe/","1536:/YlPe/t","1536:YlPe/tT","1536:lPe/tTM","1536:Pe/tTM+","1536:e/tTM+9","1536:/tTM+9u","1536:tTM+9uf","1536:TM+9ufk","1536:M+9ufk2","1536:+9ufk2N","1536:9ufk2Nk","1536:ufk2Nk3","1536:fk2Nk3Y","1536:k2Nk3Yo","1536:2Nk3YoE","1536:Nk3YoEN"],"imphash":"fc1d45e2b662c656e1a56e88c9fc63e6","pehash":"38dd5b14c19bdd71352131d865ebcbe351ffc8d0"},"file_info":{"file_name":"MSOCF.dll","file_type":["pedll","executable"],"file_type_id":"dll","file_size":126464,"entropy":6.56,"compile_timestamp":"2026-08-23T13:51:11","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1787530784000,"last_seen":1787947925000,"last_multi_scan":1787947925000},"pe_metadata":{"is_dll":true,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"embedded_file_count":3,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":76932,"raw_size":77312},{"name":".rdata","virtual_address":"0x14000","virtual_size":27172,"raw_size":27648},{"name":".data","virtual_address":"0x1b000","virtual_size":15904,"raw_size":8192},{"name":".reloc","virtual_address":"0x1f000","virtual_size":3808,"raw_size":4096},{"name":".rsrc","virtual_address":"0x20000","virtual_size":8064,"raw_size":8192}],"section_names":[".text",".rdata",".data",".reloc",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["windows-server-utility","evasive"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":111},"sandbox_signatures":{"informative_count":284,"suspicious_count":24,"malicious_count":9,"total":317},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.MalwareX-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win64.DLLhijack","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Yogi.55302","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Yogi.55302 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/ShellcodeRunner.AGW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 006e59681 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"section_entropy_high","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.IHMN-5275","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Yogi.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"suspicious","value":"Attempts to determine the valid logical drives on the computer"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Calls APIs used for find file/directory path"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Executes WMI queries to gather system information"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current hardware profile (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"References Video COM interface string"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve the local machine's name"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Drops files with image extension"},{"type":"malicious","value":"Drops system driver"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API used to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"suspicious","value":"Calls an API typically used to stop a service"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Calls APIs used for Remove Service"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"suspicious","value":"Spawned process connects to a network"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Opened the service control manager"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Contains ability to access the loader directly (API string)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"malicious","value":"Unloads system drivers using native API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"informative","value":"Contains ability to add users to a group (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Persistence","technique":"Device Registration","attack_id":"T1098.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1098/005","identifiers":[{"type":"informative","value":"Contains ability to register device notification handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains ability to connect to a messaging system (API string)"},{"type":"informative","value":"Contains ability to query/modify memory allocated by messaging system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Persistence","technique":"LSASS Driver","attack_id":"T1547.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/008","identifiers":[{"type":"malicious","value":"Loads a device driver"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"},{"type":"suspicious","value":"References COM interfaces strings prone to UAC bypass"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment"},{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match – high entropy image embedded in .NET resource"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Clear Windows Event Logs","attack_id":"T1070.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/001","identifiers":[{"type":"informative","value":"Able to remove the event logs"},{"type":"informative","value":"Able to retrieve event logs (API string)"},{"type":"informative","value":"Contains ability to delete all entries from an event log (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Contains ability to delete device driver (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"suspicious","value":"Deletes registry keys"},{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Able to identify virtual/sandbox environment devices"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"},{"type":"informative","value":"YARA signature match – PEB traversal"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Credential Access","technique":"Steal Application Access Token","attack_id":"T1528","attack_id_wiki":"https://attack.mitre.org/techniques/T1528","identifiers":[{"type":"informative","value":"Able to access AWS credential file"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Requested access to a system service"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"},{"type":"informative","value":"Calls an API typically used to enumerate logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Executes WMI queries in order to detect local security applications"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Imports network management related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"},{"type":"informative","value":"Contains ability to register RPC protocol sequence (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to compress/decompress buffers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Attempts to call internet-related API for network communication"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Imports crypto-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"sample.bin\"), Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetUserObjectInformationW\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"sample.bin\"), Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-901","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessorNumber\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandleExW\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\"), Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"9.3.5.3\", \"7.6.3.8\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"basecsp.dll\")\n file/memory contains long string(File: \"AppxSip.dll\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netlocalgroupgetmembers\"; File: \"catsrvut.dll\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to remove the event logs","description":"file/memory contains long string with (Indicator: \"evtsetchannelconfigproperty\"; File: \"bitsadmin.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-738","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to retrieve event logs (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-237","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (Source: \"00000000-00007008-00000C2C-2853901198\")\n Found string \"DeleteService\" (Source: \"00000000-00000008.00000000.246917.04BF0000.00000004.mdmp, 00000000-00000008.00000000.246917.04CF0000.00000040.mdmp\")\n Found string \"DeleteService\" (Source: \"00000000-00000400.00000001.246589.04ED0000.00000040.mdmp\")\n Found string \"DeleteService\" (Source: \"00000000-00001312.00000001.246586.04E20000.00000040.mdmp\")\n Found string \"DeleteService\" (Source: \"00000000-00003928.00000000.246917.04DB0000.00000004.mdmp, 00000000-00003928.00000000.246917.04F90000.00000040.mdmp\")\n Found string \"DeleteService\" (Source: \"00000000-00004044.00000001.246587.05650000.00000004.mdmp, 00000000-00004044.00000001.246587.057F0000.00000040.mdmp\")\n Found string \"DeleteService\" (Source: \"00000000-00004656.00000000.246912.05370000.00000004.mdmp, 00000000-00004656.00000000.246912.05470000.00000040.mdmp, 00000000-00004656.00000000.246912.05580000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to compress/decompress buffers (API string)","description":"Found reference to API \"RtlComputeCrc32\" (Indicator: \"RtlComputeCrc32\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-404","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delete all entries from an event log (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1070.001","relevance":1,"id":"string-211","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"MSOCF.dll\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"bthprops.cpl\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"bthprops.cpl\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"aadauthhelper.dll\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"aadauthhelper.dll\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform remote procedure calls (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"HashAlgorithm\"; File: \"AppxSip.dll\")\n file/memory contains long string with (Indicator: \"Oid\"; File: \"ARP.EXE\")\n Found reference to \"UsOidToCalendarUdmId\" (Indicator: \"Oid\"; File: \"MSOCF.dll\")\n Found reference to \"UsOidToTaskUdmId\" (Indicator: \"Oid\"; File: \"MSOCF.dll\")\n Found reference to \"UsOidToContactUdmId\" (Indicator: \"Oid\"; File: \"MSOCF.dll\")\n Found reference to \"Oid433\" (Indicator: \"Oid\"; Source: \"00000000-00004044.00000001.246587.056B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$30","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$31","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$32","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"rundll32.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"RT_BSS\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; File: \"ActionCenter.dll\")\n file/memory contains long string with (Indicator: \"CryptProtectMemory\"; File: \"activeds.dll\")\n file/memory contains long string with (Indicator: \"CryptProtectMemory\"; File: \"adsldpc.dll\")\n file/memory contains long string with (Indicator: \"CryptProtectMemory\"; File: \"adsldp.dll\")\n file/memory contains long string with (Indicator: \"CryptProtectMemory\"; File: \"adsmsext.dll\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; File: \"MSOCF.dll\")\n Found api reference \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKeyPair\"; File: \"MSOCF.dll\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00000008.00000000.246917.00690000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00004044.00000000.244979.00F00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$33","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$34","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n ebp in Stream UID: 17732-92-1000CA52\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 17732-92-1000CA52\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 17732-156-100092FF\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 17732-156-100092FF\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 17732-438-10009C8E\n Assembly shows XOR instruction xor ecx\n eax in Stream UID: 17732-438-10009C8E\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 17732-438-10009C8E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"MSOCF.dll\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004044.00000000.244979.00F00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptBinaryToStringW\" (Indicator: \"CryptBinaryToString\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptAcquireCertificatePrivateKey\" (Indicator: \"CryptAcquireCertificatePrivateKey\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"MSOCF.dll\")\n Found reference to API \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"$36","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptProtectData\" which can \"perform encryption on the data\" [Source: aadtb.dll]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: aadtb.dll]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$37","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$38","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"catsrv.dll\")\n file/memory contains long string(File: \"BioCredProv.dll\")\n file/memory contains long string(File: \"adsldpc.dll\")\n file/memory contains long string(File: \"adsldp.dll\")\n file/memory contains long string(File: \"appmgmts.dll\")\n file/memory contains long string(File: \"BrowserSettingSync.dll\")\n file/memory contains long string(File: \"adrclient.dll\")\n file/memory contains long string(File: \"bootcfg.exe\")\n file/memory contains long string(File: \"adprovider.dll\")\n file/memory contains long string(File: \"activeds.tlb\")\n Found string \"etUserNameA\" (Source: \"00000000-00000008.00000000.246917.00690000.00000004.mdmp\")\n Found string \"etUserNameExA\" (Source: \"00000000-00004044.00000000.244979.00F00000.00000004.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00004044.00000000.244979.00F00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"\\SystemRoot\\System32\\drivers\\vmci.sys\" (Indicator: \"\\vmci\"; Source: \"00000000-00005276.00000000.246914.00AC0000.00000004.mdmp\")\n Found string \"\\SystemRoot\\System32\\drivers\\vmmouse.sys\" (Indicator: \"vmmouse\"; Source: \"00000000-00005276.00000000.246914.00AC0000.00000004.mdmp\")\n Found string \"\\SystemRoot\\System32\\drivers\\vmusbmouse.sys\" (Indicator: \"vmusb\"; Source: \"00000000-00005276.00000000.246914.00AC0000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmmemctl.sys\" (Indicator: \"vmmemctl\"; Source: \"00000000-00005276.00000000.246914.00AC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"\\SystemRoot\\System32\\drivers\\vmci.sys\" (Indicator: \"\\vmci\"; Source: \"00000000-00005276.00000000.246914.00AC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; File: \"basecsp.dll\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"ApiSetHost.AppExecutionAlias.dll\")\n file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"AtBroker.exe\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (File: \"MSOCF.dll\")\n Found string \"QueryServiceStatusEx\" (File: \"MSOCF.dll\")\n Found string \"QueryServiceConfig2W\" (File: \"MSOCF.dll\")\n Found string \"QueryServiceConfigW\" (File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"adrclient.dll\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"bootcfg.exe\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007008-00000C2C-2827857896\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"setupdienumdeviceinfo\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"MSOCF.dll\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"MSOCF.dll\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve the local machine's name","description":"file/memory contains long string with (Indicator: \"getcomputerobjectname\"; File: \"adsldp.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-743","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007008)\n \"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004044)\n \"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000400)\n \"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001312)\n \"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004656)\n \"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005276)\n \"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003928)\n \"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000008)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"rundll32.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007008)\n \"rundll32.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00007008)\n \"rundll32.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Calls APIs used for find file/directory path","description":"Observed import api PathFindFileName (Source: AudioEng.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-183","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"rundll32.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004044)\n \"rundll32.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003928)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"rundll32.exe\" called \"GetWindowTextW\" (UID: 00000000-00004044)\n \"rundll32.exe\" called \"GetWindowTextW\" (UID: 00000000-00003928)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007008)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004044)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000400)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$43","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"rundll32.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004044)\n \"rundll32.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003928)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"rundll32.exe\" called \"GetLocaleInfoW\" with parameter \"2048\" - (UID: 00000000-00003928)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"$44","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"MSOCF.dll\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; File: \"MSOCF.dll\")\n Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004044.00000000.244979.00EB9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"MSOCF.dll\")\n Found reference to API \"FindFirstVolumeW\" (Indicator: \"FindFirstVolume\"; File: \"MSOCF.dll\")\n Found reference to API \"FindVolumeClose\" (Indicator: \"FindVolumeClose\"; File: \"MSOCF.dll\")\n Found reference to API \"FindNextVolumeW\" (Indicator: \"FindNextVolume\"; File: \"MSOCF.dll\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"MSOCF.dll\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathName\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"MSOCF.dll\")\n Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; File: \"MSOCF.dll\")\n Found reference to API \"GetVolumePathNamesForVolumeNameW\" (Indicator: \"GetVolumePathNamesForVolumeName\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"rundll32.exe\" issued a query \"SELECT displayName FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$48","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Environment Awareness","name":"References Video COM interface string","description":"Found string \"CLSID\\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\" (Indicator: \"{62be5d10-60eb-11d0-bd3b-00a0c911ce86}\"; Source: \"00000000-00004044.00000001.246587.00F00000.00000004.mdmp\")\n Found string \"CLSID\\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\" (Indicator: \"{860bb310-5d01-11d0-bd3b-00a0c911ce86}\"; Source: \"00000000-00004044.00000001.246587.00F00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-757","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA Applayer Protocol detection skipped\" (SID: 2260003, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 1339)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"AppLockerCSP.dll\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"AppxAllUserStore.dll\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"appmgmts.dll\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"AppxSip.dll\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"advpack.dll\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"MSOCF.dll\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$4c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"202.61.140.222:448\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to add users to a group (API string)","description":"Found reference to API \"NetLocalGroupAdd\" (Indicator: \"NetLocalGroupAdd\"; File: \"MSOCF.dll\")\n Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAdd\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-215","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to connect to a messaging system (API string)","description":"Found reference to API \"MAPILogonEx\" (Indicator: \"MAPILogonEx\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-178","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAddMembers\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: AcGenral.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: AppVEntSubsystems32.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: cdosys.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"MSOCF.dll\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to query/modify memory allocated by messaging system (API string)","description":"Found reference to API \"MAPIFreeBuffer\" (Indicator: \"MAPIFreeBuffer\"; File: \"MSOCF.dll\")\n Found reference to API \"MAPIAllocateBuffer\" (Indicator: \"MAPIAllocateBuffer\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-233","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$55","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: cdp.dll)\n Found MoveFileA in import section (Source: AcGenral.dll)\n Found MoveFileExW in import section (Source: cmiv2.dll)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$56","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$57","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"DLL with no export directory","description":"\"AuthFWSnapin.dll\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"\n \"bcastdvr.exe\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"\n \"autochk.exe\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"\n \"autoconv.exe\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"\n \"adtschema.dll\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"\n \"autofmt.exe\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"","origin":"Static Parser","relevance":1,"id":"static-91","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$58","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#2\" (UID: 00000000-00007008)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#1\" (UID: 00000000-00004044)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#3\" (UID: 00000000-00000400)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#4\" (UID: 00000000-00001312)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#5\" (UID: 00000000-00004656)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#6\" (UID: 00000000-00005276)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#7\" (UID: 00000000-00003928)\n Process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#8\" (UID: 00000000-00000008)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$59","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"mode.rich.rdata@.rsrc.rdata.rdata\"\n Pattern match: \"mode.rich.text@.rsrc.rdata.rdata\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$5a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$5b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74B00000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72E60000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74380000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$5c","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$5d","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"AuthFWSnapin.dll\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$5e","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$5f","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$60","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$61","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x4dd400\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x370a00\" greater than 0x100000\n Raw size of \".text\" is \"0x2ca400\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x18c200\" greater than 0x100000\n Raw size of \".text\" is \"0x1a0e00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x18e600\" greater than 0x100000\n Raw size of \".text\" is \"0x15d200\" greater than 0x100000\n Raw size of \".text\" is \"0x144400\" greater than 0x100000\n Raw size of \".text\" is \"0x122400\" greater than 0x100000\n Raw size of \".text\" is \"0x10e800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x4dd298\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x370928\" greater than 0x100000\n Virtual size of \".text\" is \"0x2ca348\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x18c038\" greater than 0x100000\n Virtual size of \".text\" is \"0x1a0d12\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x18e470\" greater than 0x100000\n Virtual size of \".text\" is \"0x15d1a5\" greater than 0x100000\n Virtual size of \".text\" is \"0x144246\" greater than 0x100000\n Virtual size of \".text\" is \"0x1222cb\" greater than 0x100000\n Virtual size of \".text\" is \"0x10e621\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"AcGenral.dll\" has high imagebase \"0x79000000\"\n \"cdosys.dll\" has high imagebase \"0x6f880000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00004044) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00004044) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"file/memory contains long string(File: \"adsldpc.dll\")\n file/memory contains long string(File: \"adsldp.dll\")\n file/memory contains long string(File: \"authz.dll\")\n file/memory contains long string(File: \"adsmsext.dll\")\n file/memory contains long string(File: \"adprovider.dll\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#1\" (UID: 00000000-00004044)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#3\" (UID: 00000000-00000400)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#4\" (UID: 00000000-00001312)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#5\" (UID: 00000000-00004656)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#6\" (UID: 00000000-00005276)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#7\" (UID: 00000000-00003928)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#8\" (UID: 00000000-00000008)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#1\" (UID: 00000000-00004044)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#3\" (UID: 00000000-00000400)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#4\" (UID: 00000000-00001312)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#5\" (UID: 00000000-00004656)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#6\" (UID: 00000000-00005276)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#7\" (UID: 00000000-00003928)\n Spawned process \"rundll32.exe\" with commandline \"\"C:\\\\MSOCF.dll\",#8\" (UID: 00000000-00000008)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$62","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"rundll32.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\sys_cache.dat\"\n \"rundll32.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\EmbeddedDriverService.sys\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"file/memory contains long string(File: \"accountaccessor.dll\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; File: \"MSOCF.dll\")\n Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to register device notification handler (API string)","description":"Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1098.005","relevance":1,"id":"string-543","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"rundll32.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$64","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"AppxProvisioning.xml\" has type \"Unknown\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$65","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$66","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 7008)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 400)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 1312)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\rundll32.exe\" (UID: 5276)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$67","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"rundll32.exe\" reads file \"c:\\windows\\syswow64\\rundll32.exe\"\n \"rundll32.exe\" reads file \"c:\\windows\\syswow64\\svchost.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$68","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\rundll32.exe\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcLayers.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\AcLayers.DLL\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mpr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$69","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$6a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"rundll32.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\sys_cache.dat\"\n \"rundll32.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\embeddeddriverservice.sys\"\n \"rundll32.exe\" writes file \"%temp%\\sys_cache.dat\"\n \"rundll32.exe\" writes file \"%temp%\\embeddeddriverservice.sys\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"rundll32.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\sys_cache.dat\"\n \"rundll32.exe\" writes a file \"%TEMP%\\sys_cache.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"file/memory contains long string with (Indicator: \"WNetGetUniversalName\"; File: \"catsrvut.dll\")\n file/memory contains long string with (Indicator: \"WNetGetUniversalName\"; File: \"adrclient.dll\")\n file/memory contains long string with (Indicator: \"WNetAddConnection\"; File: \"bootcfg.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"authfwcfg.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"authz.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"BitLockerCsp.dll\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"bootcfg.exe\")\n file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"browcli.dll\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: cdp.dll]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -st\"; File: \"catsrvut.dll\")\n file/memory contains long string with (Indicator: \"nmap -st\"; File: \"appidapi.dll\")\n file/memory contains long string with (Indicator: \"nmap -st\"; File: \"ByteCodeGenerator.exe\")\n file/memory contains long string with (Indicator: \"nmap -st\"; File: \"BOOTVID.DLL\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"MSOCF.dll\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"MSOCF.dll\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"MSOCF.dll\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"MSOCF.dll\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"MSOCF.dll\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersA\" (Indicator: \"EnumPrinters\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00007008-00000C2C-2827857762\")\n Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; Source: \"00000000-00007008-00000C2C-2827858583\")\n Found reference to API \"inet_addr\" (Indicator: \"inet_addr\"; File: \"MSOCF.dll\")\n Found reference to API \"inet_ntoa\" (Indicator: \"inet_ntoa\"; File: \"MSOCF.dll\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"wsagetlasterror\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$70","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetLocalGroupAdd\" which can \"create a local group in the security database.\" [Source: AcGenral.dll]\n Observed import api \"NetLocalGroupAddMembers\" which can \"add membership of one or more existing user accounts or global group accounts to an existing local group.\" [Source: AcGenral.dll]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"Observed import api \"WNetGetConnection\" which can \"retrieve the name of the network resource associated with a local device\" [Source: AcGenral.dll]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"AddressParser.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"altspace.dll\"\n YARA signature for RSA public and private key matched on file \"AuthFWSnapin.dll\"\n YARA signature for RSA public and private key matched on file \"AuthFWWizFwk.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in process \"00000000-00001312\"\n YARA signature matched on embedded PE in process \"00000000-00005276\"\n YARA signature matched on embedded PE in process \"00000000-00000400\"\n YARA signature matched on embedded PE in process \"00000000-00004044\"\n YARA signature matched on embedded PE in process \"00000000-00007008\"\n YARA signature matched on embedded PE in process \"00000000-00003928\"\n YARA signature matched on embedded PE in process \"00000000-00000008\"\n YARA signature matched on embedded PE in process \"00000000-00004656\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"$71","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal process \"00000000-00003928\"\n YARA signature for PEB traversal process \"00000000-00004656\"\n YARA signature for PEB traversal process \"00000000-00004044\"\n YARA signature for PEB traversal process \"00000000-00000008\"\n YARA signature for PEB traversal process \"00000000-00005276\"\n YARA signature for PEB traversal process \"00000000-00000400\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – high entropy image embedded in .NET resource","description":"YARA signature for high entropy images embedded in resource file \"AuthFWSnapin.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-214","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"MSOCF.dll\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to register RPC protocol sequence (API string)","description":"Found reference to API \"RpcServerUseProtseqEpW\" (Indicator: \"RpcServerUseProtseq\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-454","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004044.00000001.246587.00F00000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE74F53958563CEDFFB6F222B65D27]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004044.00000001.246587.00F00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"file/memory contains long string with (Indicator: \"kerberos\"; File: \"authz.dll\")\n file/memory contains long string with (Indicator: \"kerberos\"; File: \"adsmsext.dll\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004044.00000001.246587.00F00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"file/memory contains long string(File: \"azroleui.dll\")\n file/memory contains long string(File: \"avicap32.dll\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"$73","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: MSOCF.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: AcGenral.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: AppVEntSubsystems32.dll]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: AppVEntSubsystems32.dll]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"$77","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate logical drives on the computer","description":"\"rundll32.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"1000\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1680","relevance":6,"id":"api-326","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"rundll32.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"rundll32.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"bcryptprimitives.dll\")\n file/memory contains long string with (Indicator: \"rsa2\"; File: \"bcryptprimitives.dll\")\n file/memory contains long string with (Indicator: \"base32\"; File: \"AppxAllUserStore.dll\")\n file/memory contains long string with (Indicator: \"zipfile\"; File: \"AppxSip.dll\")\n file/memory contains long string with (Indicator: \"base64\"; File: \"aadauthhelper.dll\")\n file/memory contains long string with (Indicator: \".encrypt\"; File: \"BitLockerCsp.dll\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"bcrypt.dll\")\n file/memory contains long string with (Indicator: \"rsa2\"; File: \"bcrypt.dll\")\n file/memory contains long string with (Indicator: \"base64\"; File: \"bidispl.dll\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"cero.rs\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"accessibilitycpl.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"cdp.dll\" contains export function called \"DllGetClassObject\" at ordinal 103\n \"cmiv2.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"ActiveSyncProvider.dll\" contains export function called \"DllGetClassObject\" at ordinal 6\n \"AppxPackaging.dll\" contains export function called \"DllGetClassObject\" at ordinal 8\n \"AzureSettingSyncProvider.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"AudioEng.dll\" contains export function called \"DllGetClassObject\" at ordinal 4\n \"AudioSes.dll\" contains export function called \"DllGetClassObject\" at ordinal 6\n \"aadtb.dll\" contains export function called \"DllGetClassObject\" at ordinal 7\n \"cdprt.dll\" contains export function called \"DllGetClassObject\" at ordinal 3\n \"cdosys.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"azroles.dll\" contains export function called \"DllGetClassObject\" at ordinal 42","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"$79","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current hardware profile (API string)","description":"$7b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-159","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"$7c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"MSOCF.dll\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"MSOCF.dll\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"$7d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"MSOCF.dll\")\n Found reference to API \"CheckTokenMembershipEx\" (Indicator: \"CheckTokenMembership\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"MSOCF.dll\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$7e","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$80","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"rundll32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$81","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Able to access AWS credential file","description":"file/memory contains long string with (Indicator: \"security-credentials\"; File: \"basecsp.dll\")","origin":"File/Memory","mitre_attack_id":"T1528","relevance":1,"id":"string-5076","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"catsrvut.dll\")\n file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"catsrv.dll\")\n file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"AppLockerCSP.dll\")\n file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"AppManagementConfiguration.dll\")\n file/memory contains long string with (Indicator: \"changeserviceconfigw\"; File: \"appidtel.exe\")\n Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$82","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Calls APIs used for Remove Service","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: AcGenral.dll]\n Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: cmiv2.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-188","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007008)\n \"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004044)\n \"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000400)\n \"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001312)\n \"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004656)\n \"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005276)\n \"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003928)\n \"rundll32.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000008)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Calls an API used to change the configuration parameters of a service","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: AcGenral.dll]\n Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: cmiv2.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-193","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"$83","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$84","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"$85","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"MSOCF.dll\")\n Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device driver (API string)","description":"$86","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-463","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$87","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"$88","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; File: \"MSOCF.dll\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$89","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$8a","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"MSOCF.dll\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"MSOCF.dll\")\n Found reference to API \"SetProcessMitigationPolicy\" (Indicator: \"SetProcessMitigationPolicy\"; Source: \"00000000-00004044.00000000.244979.00EB9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"MSOCF.dll\")\n Found reference to API \"LsaAddAccountRights\" (Indicator: \"LsaAddAccountRights\"; File: \"MSOCF.dll\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"MSOCF.dll\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$8b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"rundll32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"rundll32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"TYPE\"; Value: \"0100000000\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"START\"; Value: \"0300000000\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"ERRORCONTROL\"; Value: \"0100000000\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"IMAGEPATH\"; Value: \"%TEMP%\\EmbeddedDriverService.sys\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$8c","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"rundll32.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$8d","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"TYPE\"; Value: \"0100000000\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"START\"; Value: \"0300000000\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"ERRORCONTROL\"; Value: \"0100000000\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\"; Key: \"IMAGEPATH\"; Value: \"%TEMP%\\EmbeddedDriverService.sys\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"$8e","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$8f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"EmbeddedDriverService.sys\" has type \"PE32+ executable for MS Windows 10.00 (native) x86-64 8 sections\"- Location: [%TEMP%\\EmbeddedDriverService.sys]- [targetUID: 00000000-00000400]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"@WirelessDisplayToast.png\" has type \"PNG image data 64 x 64 8-bit/color RGBA non-interlaced\" and extension \"png\"\n \"@VpnToastIcon.png\" has type \"PNG image data 64 x 64 4-bit colormap non-interlaced\" and extension \"png\"\n \"@EnrollmentToastIcon.png\" has type \"PNG image data 71 x 71 8-bit gray+alpha non-interlaced\" and extension \"png\"\n \"@AudioToastIcon.png\" has type \"PNG image data 44 x 44 8-bit gray+alpha non-interlaced\" and extension \"png\"\n \"@BthpropsNotificationLogo.png\" has type \"PNG image data 32 x 32 8-bit/color RGBA non-interlaced\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$90","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"??\\C:\\Windows\\System32\\RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"MSOCF.dll\" has section name .rsrc with entropy \"7.753067370048392\"\n \"AudioEng.dll\" has section name .text with entropy \"7.028127229084725\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/24 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"rundll32.exe\" called \"OpenSCManagerA\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)\n \"rundll32.exe\" called \"OpenSCManagerA\" requesting access rights \"SC_MANAGER_CREATE_SERVICE\" (0x2)","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"$91","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"rundll32.exe\" called \"OpenServiceA\" to access the \"EmbeddedDriverService\" service requesting \"SERVICE_ALL_ACCESS\" (0XF01FF) access rights","origin":"API Call","mitre_attack_id":"T1007","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$92","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"rundll32.exe\" wrote 35400 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\EmbeddedDriverService.sys\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"rundll32.exe\" called \"gethostname\" with parameters (UID: 00000000-00004044)\n \"rundll32.exe\" called \"gethostname\" with parameters (UID: 00000000-00003928)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\SysWOW64\\rundll32.exe\" connects to 202.61.140.222 on port 448 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to determine the valid logical drives on the computer","description":"\"rundll32.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"1000\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1083","relevance":10,"id":"api-286","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to determine the valid logical drives on the computer","description":"\"rundll32.exe\" called \"GetLogicalDriveStringsW\" with parameters {\"nBufferLength\": \"1000\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-109","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"rundll32.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00007008)\n \"rundll32.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00007008)\n \"rundll32.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00007008)\n \"rundll32.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00007008)\n \"rundll32.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00007008)\n \"rundll32.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00007008)\n \"rundll32.exe\" called \"Process32NextW with parameter services.exe\" (UID: 00000000-00007008)\n \"rundll32.exe\" called \"Process32NextW with parameter lsass.exe\" (UID: 00000000-00007008)\n \"rundll32.exe\" called \"Process32NextW with parameter svchost.exe\" (UID: 00000000-00007008)\n \"rundll32.exe\" called \"Process32NextW with parameter fontdrvhost.exe\" (UID: 00000000-00007008)\n \"rundll32.exe\" called \"Process32NextW with parameter dwm.exe\" (UID: 00000000-00007008)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"$93","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Executes WMI queries to gather system information","description":"\"rundll32.exe\" issued a query \"SELECT displayName FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-183","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"rundll32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"rundll32.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\EmbeddedDriverService.sys\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"rundll32.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\EmbeddedDriverService.sys\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to stop a service","description":"\"rundll32.exe\" called \"ControlService\" with SERVICE_CONTROL_STOP access on service handle 5d78b8\n \"rundll32.exe\" called \"ControlService\" with SERVICE_CONTROL_STOP access on service handle 937778\n \"rundll32.exe\" called \"ControlService\" with SERVICE_CONTROL_STOP access on service handle 3127660\n \"rundll32.exe\" called \"ControlService\" with SERVICE_CONTROL_STOP access on service handle ad7408\n \"rundll32.exe\" called \"ControlService\" with SERVICE_CONTROL_STOP access on service handle af6770\n \"rundll32.exe\" called \"ControlService\" with SERVICE_CONTROL_STOP access on service handle b173b8\n \"rundll32.exe\" called \"ControlService\" with SERVICE_CONTROL_STOP access on service handle 6d4828","origin":"API Call","mitre_attack_id":"T1489","relevance":10,"id":"api-277","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"System Security","name":"Deletes registry keys","description":"\"rundll32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\CC\\0\"; Key: \"R32F351A4AEEA5E608853D1A56661059\"; Value: \"\")\n \"rundll32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\CONSOLE\\0\"; Key: \"3C55EC603B6008FE03B40915B595078E\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1070","relevance":3,"id":"registry-170","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"rundll32.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"System Security","name":"References COM interfaces strings prone to UAC bypass","description":"$94","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":7,"id":"string-73","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$95","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$96","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"$97","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"rundll32.exe\" connects to 202.61.140.222:448","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops system driver","description":"\"autochk.exe\" has type \"PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections\"\n \"autoconv.exe\" has type \"PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections\"\n \"autofmt.exe\" has type \"PE32 executable for MS Windows 10.00 (native) Intel i386 5 sections\"\n \"atmfd.dll\" has type \"PE32 executable for MS Windows 10.00 (native) Intel i386 6 sections\"\n \"EmbeddedDriverService.sys\" has type \"PE32+ executable for MS Windows 10.00 (native) x86-64 8 sections\"\n \"BOOTVID.DLL\" has type \"PE32 executable for MS Windows 10.00 (native) Intel i386 7 sections\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-2","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads a device driver","description":"\"rundll32.exe\" loaded driver \"NtLoadDriver\"","origin":"API Call","mitre_attack_id":"T1547.008","relevance":10,"id":"api-41","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"rundll32.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00007008)\n \"rundll32.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00000400)\n \"rundll32.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00001312)\n \"rundll32.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00004656)\n \"rundll32.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00005276)\n \"rundll32.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00000008)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"rundll32.exe\" issued a query \"SELECT displayName FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1518.001","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"level":"malicious","category":"System Security","name":"Unloads system drivers using native API calls","description":"$98","origin":"API Call","mitre_attack_id":"T1543.003","relevance":10,"id":"api-319","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Executes WMI queries in order to detect local security applications"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping multiple times"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Attempts to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]}],"intel_graph":{"map":{"File:00ef46a47ca50a301e1171d4fcb181e9a08ef63be060e745637fdb9ab0d42c54":{"type":"File","value":"00ef46a47ca50a301e1171d4fcb181e9a08ef63be060e745637fdb9ab0d42c54"},"File:02743fa56963717e2c996dc014fa9d9f36efb84ddb78b24a05688c3f9b3251e8":{"type":"File","value":"02743fa56963717e2c996dc014fa9d9f36efb84ddb78b24a05688c3f9b3251e8"},"File:035fcc03fcf79de11c086c70a0000d6833940ce329eb0fe408ffbd2126f7309f":{"type":"File","value":"035fcc03fcf79de11c086c70a0000d6833940ce329eb0fe408ffbd2126f7309f"},"File:06c4d0b63a4f89e1ff744845295bbcc0ef5987b85ba8b9ec66be9e7a39dd3633":{"type":"File","value":"06c4d0b63a4f89e1ff744845295bbcc0ef5987b85ba8b9ec66be9e7a39dd3633"},"File:086769a44ee43503c4191e83a3a6c7923fce8a27252f979be7b0f8158427b931":{"type":"File","value":"086769a44ee43503c4191e83a3a6c7923fce8a27252f979be7b0f8158427b931"},"File:0b729ea4e4b1650371d0279a2c2a9ebbb528c37532443193cf218c85f39c3085":{"type":"File","value":"0b729ea4e4b1650371d0279a2c2a9ebbb528c37532443193cf218c85f39c3085"},"File:1479b1f834ee9205aef5e06a6594d47361cc2fc8074ca6153b1bc7eae514165e":{"type":"File","value":"1479b1f834ee9205aef5e06a6594d47361cc2fc8074ca6153b1bc7eae514165e"},"File:14821aad4cd1c5a6177003f27237e85eaab52e170a031254d76aee6fbe0cd7b6":{"type":"File","value":"14821aad4cd1c5a6177003f27237e85eaab52e170a031254d76aee6fbe0cd7b6"},"File:16abda71d7ce417b9d33e859d4a76b682b03b29df661553654baa837d1bef63e":{"type":"File","value":"16abda71d7ce417b9d33e859d4a76b682b03b29df661553654baa837d1bef63e"},"File:17bfd7de3b9913c6f98cf12ef525664039ce83c5ea3cc471fb19ca60e8841454":{"type":"File","value":"17bfd7de3b9913c6f98cf12ef525664039ce83c5ea3cc471fb19ca60e8841454"},"File:181193a09a8227a24686bd6a3ae8cfe302e4ec90384802c9fed0ac352c993568":{"type":"File","value":"181193a09a8227a24686bd6a3ae8cfe302e4ec90384802c9fed0ac352c993568"},"File:191d92c4c10fd37d455dd91221f2f8c732bb17e87857aa49d9e7b7850fc438cd":{"type":"File","value":"191d92c4c10fd37d455dd91221f2f8c732bb17e87857aa49d9e7b7850fc438cd"},"File:1ad6abbeacaa0fff14631094cdef96fc98e9cd6703abf1e846a2514c1485fb22":{"type":"File","value":"1ad6abbeacaa0fff14631094cdef96fc98e9cd6703abf1e846a2514c1485fb22"},"File:1cf327fa3ad93b5d53c9536035f95a41369466f5a769fdad68408f1c9823feb2":{"type":"File","value":"1cf327fa3ad93b5d53c9536035f95a41369466f5a769fdad68408f1c9823feb2"},"File:1d51be86ebd68016d3e0744c1fa9cc8e6be9ab3b14da98e12a4fa5e30ef23d4a":{"type":"File","value":"1d51be86ebd68016d3e0744c1fa9cc8e6be9ab3b14da98e12a4fa5e30ef23d4a"},"File:207d35b0d247d8ccd2d9c9c5e7a423e1626a6c3cd9c0db99eaba25232808dc73":{"type":"File","value":"207d35b0d247d8ccd2d9c9c5e7a423e1626a6c3cd9c0db99eaba25232808dc73"},"File:223473401d7c1631f31c002c764ad490bf75fa77f6f2cab20b1583cb33ce1543":{"type":"File","value":"223473401d7c1631f31c002c764ad490bf75fa77f6f2cab20b1583cb33ce1543"},"File:223a9f556d330430ac1c1d9691e14ecc4f3c89fd7ddd608e5e7141fe7fcb075f":{"type":"File","value":"223a9f556d330430ac1c1d9691e14ecc4f3c89fd7ddd608e5e7141fe7fcb075f"},"File:224415d3654759f84083d0ba7898bc712a56e2eaae4eb55c417ccbdef7b5e16c":{"type":"File","value":"224415d3654759f84083d0ba7898bc712a56e2eaae4eb55c417ccbdef7b5e16c"},"File:2457bbfc5bfee27705fbad896ee28327ffbad20d56bf333f837711e0cfa20180":{"type":"File","value":"2457bbfc5bfee27705fbad896ee28327ffbad20d56bf333f837711e0cfa20180"},"File:2529f9823517f572f5f6574d6910278fcc0c0ef0f01f392c05c96f3c10225f9a":{"type":"File","value":"2529f9823517f572f5f6574d6910278fcc0c0ef0f01f392c05c96f3c10225f9a"},"File:255470331f63a0106cdeaed430131efa33679f110a20383916f586006a679498":{"type":"File","value":"255470331f63a0106cdeaed430131efa33679f110a20383916f586006a679498"},"File:25862d27200b8c2fd40aba3cbbdd29281c3d5f81b77cb24312bc3874e9c4fe6e":{"type":"File","value":"25862d27200b8c2fd40aba3cbbdd29281c3d5f81b77cb24312bc3874e9c4fe6e"},"File:25b2899000157a07aa90ea02474cbfa11dcb32933ef24f941e2c31afaf1f95cb":{"type":"File","value":"25b2899000157a07aa90ea02474cbfa11dcb32933ef24f941e2c31afaf1f95cb"},"File:26afc05ecad5732940aaa59b44262b1bf56a67d72cd8f2a29b05bd5e15aa5490":{"type":"File","value":"26afc05ecad5732940aaa59b44262b1bf56a67d72cd8f2a29b05bd5e15aa5490"},"File:273a455af3ad373ab68a7ebc7025454bfd6d048e25eb51015a2aa30883347cec":{"type":"File","value":"273a455af3ad373ab68a7ebc7025454bfd6d048e25eb51015a2aa30883347cec"},"File:281ce3cfa9418eb90aa0cf2196ca6ed630ee3635df85246c3da2b5efa0ecf395":{"type":"File","value":"281ce3cfa9418eb90aa0cf2196ca6ed630ee3635df85246c3da2b5efa0ecf395"},"File:28ea8be5aeef3b0835ea94ebf033c0362ce5cbf4b8cdaf45e442c85075753933":{"type":"File","value":"28ea8be5aeef3b0835ea94ebf033c0362ce5cbf4b8cdaf45e442c85075753933"},"File:293064849f4667a027a8b2f686030d5ffd4701434d9b1dbb6e40ac66f32a5ce6":{"type":"File","value":"293064849f4667a027a8b2f686030d5ffd4701434d9b1dbb6e40ac66f32a5ce6"},"File:2b1a16dd7c756b04f6fb919d867527ab4b33e3e013bd4ed146b05aaf94390ab6":{"type":"File","value":"2b1a16dd7c756b04f6fb919d867527ab4b33e3e013bd4ed146b05aaf94390ab6"},"File:2bb39e21d803e74302e635f6a521bf887bbd05c214894647ec93cf9d76a3ab25":{"type":"File","value":"2bb39e21d803e74302e635f6a521bf887bbd05c214894647ec93cf9d76a3ab25"},"File:2fadffbbf9c249a6ffdcae6e70f23d85f027ef220cf7a0015d8cec1c075790a0":{"type":"File","value":"2fadffbbf9c249a6ffdcae6e70f23d85f027ef220cf7a0015d8cec1c075790a0"},"File:30edc6840e2dbac4505d29698661ccebf77d435da3e209d26960ae03051ff462":{"type":"File","value":"30edc6840e2dbac4505d29698661ccebf77d435da3e209d26960ae03051ff462"},"File:325a08926b965cce6ee134c851b74f4e13c8588a75c662448acdadb1ffce5d18":{"type":"File","value":"325a08926b965cce6ee134c851b74f4e13c8588a75c662448acdadb1ffce5d18"},"File:32ec6326f16a05f434030ab7dd5ee26eb2afb4c66446c9cb7a9814df638733ac":{"type":"File","value":"32ec6326f16a05f434030ab7dd5ee26eb2afb4c66446c9cb7a9814df638733ac"},"File:3472172b9d534c07c05414ed9081712b4b7ec85df7a4d20c20a465c173ba3be9":{"type":"File","value":"3472172b9d534c07c05414ed9081712b4b7ec85df7a4d20c20a465c173ba3be9"},"File:35b6b02b8a3b2be5aaed6525b88d4f660e893cba1614132feb88527d541b3af5":{"type":"File","value":"35b6b02b8a3b2be5aaed6525b88d4f660e893cba1614132feb88527d541b3af5"},"File:374f316f063f0f86163ec5206fb195de50c01951126cc90438462d9d1e7262d4":{"type":"File","value":"374f316f063f0f86163ec5206fb195de50c01951126cc90438462d9d1e7262d4"},"File:3761f394e9c5eb155a6520e19c981efd1a4df06b19a39c4be5056ed79e015dbc":{"type":"File","value":"3761f394e9c5eb155a6520e19c981efd1a4df06b19a39c4be5056ed79e015dbc"},"File:389dfd23e89e62cdb29bdcb6aa282717608cb7cd026762453844123d9ed8fefd":{"type":"File","value":"389dfd23e89e62cdb29bdcb6aa282717608cb7cd026762453844123d9ed8fefd"},"File:38aef924cdd029f262cf67e0fd918f7460b600a2bc88dceec88eee67a92dc713":{"type":"File","value":"38aef924cdd029f262cf67e0fd918f7460b600a2bc88dceec88eee67a92dc713"},"File:3c3046df53d34c97b703c259a1b829ac104bde7d43dbee734ae4acb6f4c10366":{"type":"File","value":"3c3046df53d34c97b703c259a1b829ac104bde7d43dbee734ae4acb6f4c10366"},"File:41c56cf3ae55994d08fc7d6622ead753e59e6b6d90072d6c621aa71c12017616":{"type":"File","value":"41c56cf3ae55994d08fc7d6622ead753e59e6b6d90072d6c621aa71c12017616"},"File:422972ad755db8f1152ab9d250d931cce0e3d527be47dc8e24c436c32bbdeaa7":{"type":"File","value":"422972ad755db8f1152ab9d250d931cce0e3d527be47dc8e24c436c32bbdeaa7"},"File:43b107c7a882ffdd1ce4422d50d902bdeba8a6db35e18ad0c6515b148b95f20f":{"type":"File","value":"43b107c7a882ffdd1ce4422d50d902bdeba8a6db35e18ad0c6515b148b95f20f"},"File:4574417c613859da5e1fd74400f7e2ce7f6fccf4a75b93ad59cbdab4c3b2f081":{"type":"File","value":"4574417c613859da5e1fd74400f7e2ce7f6fccf4a75b93ad59cbdab4c3b2f081"},"File:495627c7b92e9e0e415a21ac2d0d04ceb3f4d6d55206de8083154c310254aa88":{"type":"File","value":"495627c7b92e9e0e415a21ac2d0d04ceb3f4d6d55206de8083154c310254aa88"},"File:4b840c686636d0250204ec2b960f577f600f63ff772aa484bcf2f6be876deedb":{"type":"File","value":"4b840c686636d0250204ec2b960f577f600f63ff772aa484bcf2f6be876deedb"},"File:4b8f8b44d0a4e8c7fcdeae8163140817c2bf2bef2d6b0f3e3d37313874da13e3":{"type":"File","value":"4b8f8b44d0a4e8c7fcdeae8163140817c2bf2bef2d6b0f3e3d37313874da13e3"},"File:4c575fa901ca678ceb5289fa2f6bdf5ad02d065ad953109f0883ce3d4e670191":{"type":"File","value":"4c575fa901ca678ceb5289fa2f6bdf5ad02d065ad953109f0883ce3d4e670191"},"File:4d0506a2aea1dcf3d3dc11277b785fbf36dee4c27ba96ce60f24c846bf32f09a":{"type":"File","value":"4d0506a2aea1dcf3d3dc11277b785fbf36dee4c27ba96ce60f24c846bf32f09a"},"File:4e084ca2caeeadd684bf52ab72244c879eb3f634af5f4fccf11e91439baf79cd":{"type":"File","value":"4e084ca2caeeadd684bf52ab72244c879eb3f634af5f4fccf11e91439baf79cd"},"File:4e76d807dd41e3c2c9343616159b6a73f3d7d5c0e73e40ea862287d7b27e7d4d":{"type":"File","value":"4e76d807dd41e3c2c9343616159b6a73f3d7d5c0e73e40ea862287d7b27e7d4d"},"File:4f952fea77b5b7f755271ec1e7250cea8d86670b2ebca16990856dc0c447cd82":{"type":"File","value":"4f952fea77b5b7f755271ec1e7250cea8d86670b2ebca16990856dc0c447cd82"},"File:50c9d68660d54b1b6a01a9113340e43297d4b0835ab466090b4e21edb01cc138":{"type":"File","value":"50c9d68660d54b1b6a01a9113340e43297d4b0835ab466090b4e21edb01cc138"},"File:513e6aede759a66603b4aa0576ece14c7d6076aea8c399708ac5aa949523d92d":{"type":"File","value":"513e6aede759a66603b4aa0576ece14c7d6076aea8c399708ac5aa949523d92d"},"File:52104c4702442bb63169f669d48f329ff81abb06d469ff822ef405a02ee4e10d":{"type":"File","value":"52104c4702442bb63169f669d48f329ff81abb06d469ff822ef405a02ee4e10d"},"File:528367d7eb367a52d1d4c9e20e97088e4f7c7391c675d109be903c4a97038f98":{"type":"File","value":"528367d7eb367a52d1d4c9e20e97088e4f7c7391c675d109be903c4a97038f98"},"File:5439f31222340cd858c6e55c70fde29e0c0a8f2593d2e8e47b8aa8cdf06e7945":{"type":"File","value":"5439f31222340cd858c6e55c70fde29e0c0a8f2593d2e8e47b8aa8cdf06e7945"},"File:56853a5ee8d88a5aed4321b8e7f9ffee509651d86a3fee956b9a73ff924bb8b4":{"type":"File","value":"56853a5ee8d88a5aed4321b8e7f9ffee509651d86a3fee956b9a73ff924bb8b4"},"File:574498d1c77f4c2dde536838e6b47bc2e3d9f647922e84e6bef45a33b2fb90e2":{"type":"File","value":"574498d1c77f4c2dde536838e6b47bc2e3d9f647922e84e6bef45a33b2fb90e2"},"File:58ba879097ceb35a24a986ebff18c739849ce1052c31275004d6a5923f0a0f4b":{"type":"File","value":"58ba879097ceb35a24a986ebff18c739849ce1052c31275004d6a5923f0a0f4b"},"File:59814609eddb844d34b993a2d5501a128d54bdf4138a8848878430500a632b2c":{"type":"File","value":"59814609eddb844d34b993a2d5501a128d54bdf4138a8848878430500a632b2c"},"File:5b3ed0fef08bb59f8da9edd75b9abbc4715c88476ecf3c054572a43871785637":{"type":"File","value":"5b3ed0fef08bb59f8da9edd75b9abbc4715c88476ecf3c054572a43871785637"},"File:5b583d6ef5599d05f66d7a82a44e5c8a0d6cd9911b511389c6b1de9705a92eca":{"type":"File","value":"5b583d6ef5599d05f66d7a82a44e5c8a0d6cd9911b511389c6b1de9705a92eca"},"File:5bb1cc0ffa340b1a0e524339b0a00b57d7b0893498adadff708a122c8c6c66f8":{"type":"File","value":"5bb1cc0ffa340b1a0e524339b0a00b57d7b0893498adadff708a122c8c6c66f8"},"File:5c1d778ed829803eaa99ea19ef2828e00fa7e6ea89a66deea708400aba70998b":{"type":"File","value":"5c1d778ed829803eaa99ea19ef2828e00fa7e6ea89a66deea708400aba70998b"},"File:5d2d07446fd83be975a14e620226aad777c6242d3765ec3f1ef4677f615aac0d":{"type":"File","value":"5d2d07446fd83be975a14e620226aad777c6242d3765ec3f1ef4677f615aac0d"},"File:5e59c4875fc7af94aa9a873acdd93d8da797ae2dc58e6b3ced8701eda610478d":{"type":"File","value":"5e59c4875fc7af94aa9a873acdd93d8da797ae2dc58e6b3ced8701eda610478d"},"File:61d95b5ce7489c99f5950b16237861211966c93b558007d00d2fac5f60e50650":{"type":"File","value":"61d95b5ce7489c99f5950b16237861211966c93b558007d00d2fac5f60e50650"},"File:61f18aa5ff48b390e47fa42838ee1bf7d8c0f160417c2df65aafb8359363cea1":{"type":"File","value":"61f18aa5ff48b390e47fa42838ee1bf7d8c0f160417c2df65aafb8359363cea1"},"File:64a0fb50f1c7c1f5b02717c155ae5f6b0cbf3318c68e891a1245c90e6d8ab71d":{"type":"File","value":"64a0fb50f1c7c1f5b02717c155ae5f6b0cbf3318c68e891a1245c90e6d8ab71d"},"File:67b0620f971072ba2b9e46465897afb74d92a503364571fc2249f7bdf148208a":{"type":"File","value":"67b0620f971072ba2b9e46465897afb74d92a503364571fc2249f7bdf148208a"},"File:68f7aa0cfed36a385bb3eaac4502f221c88b92b85c421f34c82ee874991b415b":{"type":"File","value":"68f7aa0cfed36a385bb3eaac4502f221c88b92b85c421f34c82ee874991b415b"},"File:6ba7ce4fde8ba3d0c44576e33ac71f27267f0a028abc41aeab17b2994d03b569":{"type":"File","value":"6ba7ce4fde8ba3d0c44576e33ac71f27267f0a028abc41aeab17b2994d03b569"},"File:6ff1f9d5f5d13ef8288c999a7f966a068d5fe5c0b29c9a4476d5c7f53833cf1c":{"type":"File","value":"6ff1f9d5f5d13ef8288c999a7f966a068d5fe5c0b29c9a4476d5c7f53833cf1c"},"File:700a0ca0ba2efedda6536ddf7905e658890e76b327942a4d8a6afa31a23450b2":{"type":"File","value":"700a0ca0ba2efedda6536ddf7905e658890e76b327942a4d8a6afa31a23450b2"},"File:70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b":{"type":"File","value":"70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b"},"File:713c21e79be3b0bbd0e98eddc18ed063282fbbcd0e40330972b55062f1d1aacd":{"type":"File","value":"713c21e79be3b0bbd0e98eddc18ed063282fbbcd0e40330972b55062f1d1aacd"},"File:714507650c0a0a217c4d00172e285472e991682e56b921e9294a36478dba91a8":{"type":"File","value":"714507650c0a0a217c4d00172e285472e991682e56b921e9294a36478dba91a8"},"File:71f3b92fdfea156f38ffda7e6bf36a004483598df77cc04c620758355a656a71":{"type":"File","value":"71f3b92fdfea156f38ffda7e6bf36a004483598df77cc04c620758355a656a71"},"File:74855b1061b567b7bf78d3954436583bbff23b9b5cb0770462606f9f01d0ad16":{"type":"File","value":"74855b1061b567b7bf78d3954436583bbff23b9b5cb0770462606f9f01d0ad16"},"File:7673d11a2028d9949b4b70c56457c057e3680e1a61e885b48df243991a21c6ee":{"type":"File","value":"7673d11a2028d9949b4b70c56457c057e3680e1a61e885b48df243991a21c6ee"},"File:77562d442b83f1fab89f446a4524261d16a9761d2616a7e3a6d0d8b0da86f8cf":{"type":"File","value":"77562d442b83f1fab89f446a4524261d16a9761d2616a7e3a6d0d8b0da86f8cf"},"File:79ec63e1f7f3a94890a9b4d372483f8ea0d953b3a30c81edf1810e64aef87a90":{"type":"File","value":"79ec63e1f7f3a94890a9b4d372483f8ea0d953b3a30c81edf1810e64aef87a90"},"File:79fc01ce5f7141a9e305a31197f3274feb7885f70ef5b216edfc9217f5b59b44":{"type":"File","value":"79fc01ce5f7141a9e305a31197f3274feb7885f70ef5b216edfc9217f5b59b44"},"File:7a8bf6bdabed856713c7c9f6eabc26e0b0d39fa5cd9fce9c3f95e3e7f23981a4":{"type":"File","value":"7a8bf6bdabed856713c7c9f6eabc26e0b0d39fa5cd9fce9c3f95e3e7f23981a4"},"File:7b7caf6f157f9157d0fa6fbdf5ed2eef0250b10ecd6187bcb8463d5ff7adf6e6":{"type":"File","value":"7b7caf6f157f9157d0fa6fbdf5ed2eef0250b10ecd6187bcb8463d5ff7adf6e6"},"File:7b823be337ac66f29fd0ae98f82c4d2f5ceae9be3cbdc1029f57b5476998490c":{"type":"File","value":"7b823be337ac66f29fd0ae98f82c4d2f5ceae9be3cbdc1029f57b5476998490c"},"File:7c2e2d1b55a3cc2bd65c786f5c7b28ab2e513ea9da6be010b903437e414a6275":{"type":"File","value":"7c2e2d1b55a3cc2bd65c786f5c7b28ab2e513ea9da6be010b903437e414a6275"},"File:7e38c120f3a93d385c0ab0b0592ff616aefd4899a5138f39e60d853bfa20b747":{"type":"File","value":"7e38c120f3a93d385c0ab0b0592ff616aefd4899a5138f39e60d853bfa20b747"},"File:8312f13f0eb0cb00984a1e92738afdd5a2fc2f10e891ee3b127c536a9d325dbc":{"type":"File","value":"8312f13f0eb0cb00984a1e92738afdd5a2fc2f10e891ee3b127c536a9d325dbc"},"File:844f1d05053b3009d0ec0993cc7a687d2b905f9322d6662906d54fcf8e245a9b":{"type":"File","value":"844f1d05053b3009d0ec0993cc7a687d2b905f9322d6662906d54fcf8e245a9b"},"File:84a6118575553c8723deb73056a45e6363100954986c538ff61176b44ca2e4db":{"type":"File","value":"84a6118575553c8723deb73056a45e6363100954986c538ff61176b44ca2e4db"},"File:869f79d4b8cec1f4fb9941a7cff44e0731c0ce041ec751ad71c6339d30b7cfe5":{"type":"File","value":"869f79d4b8cec1f4fb9941a7cff44e0731c0ce041ec751ad71c6339d30b7cfe5"},"File:87dbd2b9dcea628b5f0ae62d005d4d2c5419773b86f785cc4380e7c254d9a300":{"type":"File","value":"87dbd2b9dcea628b5f0ae62d005d4d2c5419773b86f785cc4380e7c254d9a300"},"File:8a6c615c9a72b3ed18b528b8f82afbadf4f916e701c15534935a1cf84899d0f3":{"type":"File","value":"8a6c615c9a72b3ed18b528b8f82afbadf4f916e701c15534935a1cf84899d0f3"},"File:8b4aeb7b7058dcd976b727b24836c0e6329f33dc80b66846bf659cd3f0aecb33":{"type":"File","value":"8b4aeb7b7058dcd976b727b24836c0e6329f33dc80b66846bf659cd3f0aecb33"},"File:8c08beedc424247e4ca462220c70f74432f925fdaaff5626093b3c5aa65482d2":{"type":"File","value":"8c08beedc424247e4ca462220c70f74432f925fdaaff5626093b3c5aa65482d2"},"File:9256b0033e037d491f57b31685eb606620c2622bd200f47243c10a0e1a7dbc0d":{"type":"File","value":"9256b0033e037d491f57b31685eb606620c2622bd200f47243c10a0e1a7dbc0d"},"File:92c03a27efdeb4b87eab5f60a3b389396fa21e1e14551ef0ecbef4f4ffa124e3":{"type":"File","value":"92c03a27efdeb4b87eab5f60a3b389396fa21e1e14551ef0ecbef4f4ffa124e3"},"File:92f29048233840e5eb29f07d56ab2d7420e59b77cb0d1e11519f0b0a0feb5103":{"type":"File","value":"92f29048233840e5eb29f07d56ab2d7420e59b77cb0d1e11519f0b0a0feb5103"},"File:937779884acc39b73c28c2434bf1c7739532096f4c40a3ae7dc2e4662a25fe5f":{"type":"File","value":"937779884acc39b73c28c2434bf1c7739532096f4c40a3ae7dc2e4662a25fe5f"},"File:99241b09a2f242761c4142691280a7200a58d70006e413b5c827712bde32975e":{"type":"File","value":"99241b09a2f242761c4142691280a7200a58d70006e413b5c827712bde32975e"},"File:9aa15b90f5fd74ca10eaad215acab4871e38fe1a0f831f0cf4d861b4ee0fb9d4":{"type":"File","value":"9aa15b90f5fd74ca10eaad215acab4871e38fe1a0f831f0cf4d861b4ee0fb9d4"},"File:9ae80642a7e931105462ab73e2eaad7e0fc54a9cab9c00630ba010c780febe25":{"type":"File","value":"9ae80642a7e931105462ab73e2eaad7e0fc54a9cab9c00630ba010c780febe25"},"File:9ea5864a82930feed447360c3931dc3c438801481d31f2cb6047a938adbe0292":{"type":"File","value":"9ea5864a82930feed447360c3931dc3c438801481d31f2cb6047a938adbe0292"},"File:9f2bcff23a8591c310bf298576ef28d20ffde451c0de3e1136b8ff1c1f1c4d1c":{"type":"File","value":"9f2bcff23a8591c310bf298576ef28d20ffde451c0de3e1136b8ff1c1f1c4d1c"},"File:a2e3b7b7b3657a2d4344d6c40df795866225b024d0c853a48bc6b6740dc9700c":{"type":"File","value":"a2e3b7b7b3657a2d4344d6c40df795866225b024d0c853a48bc6b6740dc9700c"},"File:a469d7e592d8729b552d402123ba27fd1b501f3193a91a6ef7f1bf08c08d9bb0":{"type":"File","value":"a469d7e592d8729b552d402123ba27fd1b501f3193a91a6ef7f1bf08c08d9bb0"},"File:a53eddd431c0a0164603f852e6e96bb8bef0deab2afa89a6a231e72501aa7dd9":{"type":"File","value":"a53eddd431c0a0164603f852e6e96bb8bef0deab2afa89a6a231e72501aa7dd9"},"File:a550de53478bc162001469abbebcb0e9fa2194c24ae7b344f6b6f28147f395d8":{"type":"File","value":"a550de53478bc162001469abbebcb0e9fa2194c24ae7b344f6b6f28147f395d8"},"File:a65dffcc557f0a53ee2e5aa0cdd4ba7bb2c8834364c93972447f3eb90c3cd575":{"type":"File","value":"a65dffcc557f0a53ee2e5aa0cdd4ba7bb2c8834364c93972447f3eb90c3cd575"},"File:a7fce884389705de40a5fb6883d5b4ef39a961c706d4639c13ebded8b5cf6b72":{"type":"File","value":"a7fce884389705de40a5fb6883d5b4ef39a961c706d4639c13ebded8b5cf6b72"},"File:a804331a4ed0ae77eb8959c537f606ff9ebd9d1f5ef1d16c20b286d8b2bd14f8":{"type":"File","value":"a804331a4ed0ae77eb8959c537f606ff9ebd9d1f5ef1d16c20b286d8b2bd14f8"},"File:a80f433d31310fa9f7f0bb07c1c9155f31ebfab3ae0d87a026385df9c9e9a317":{"type":"File","value":"a80f433d31310fa9f7f0bb07c1c9155f31ebfab3ae0d87a026385df9c9e9a317"},"File:ac418e936e7fbba7ef3668a7341ea37123085c44e03db1731f5f90b1d73bac97":{"type":"File","value":"ac418e936e7fbba7ef3668a7341ea37123085c44e03db1731f5f90b1d73bac97"},"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab":{"type":"File","value":"ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab"},"File:add1ace36330709c34ed24be8c221e1e8ad5849be0219b5db3c4997db52b0f19":{"type":"File","value":"add1ace36330709c34ed24be8c221e1e8ad5849be0219b5db3c4997db52b0f19"},"File:afff8491cceaf206852e72983167f65ea740dd92b4b1bbfccd59a70470968a16":{"type":"File","value":"afff8491cceaf206852e72983167f65ea740dd92b4b1bbfccd59a70470968a16"},"File:b2e2277c887443d7d24b115672d491abf62339f136eb985e3263cfd9ae43b38d":{"type":"File","value":"b2e2277c887443d7d24b115672d491abf62339f136eb985e3263cfd9ae43b38d"},"File:b479f9bf12df433162f9c82eb62fa8c62f09b4be2cd8657d3a73601fb60b293d":{"type":"File","value":"b479f9bf12df433162f9c82eb62fa8c62f09b4be2cd8657d3a73601fb60b293d"},"File:b692dce4de10fa19b0967f6a9256502d7a4880c799203750cca6977df43ba9fa":{"type":"File","value":"b692dce4de10fa19b0967f6a9256502d7a4880c799203750cca6977df43ba9fa"},"File:b77fa0943cfbe26b2a65d5d630644a85c57471647cceb7d085da421bd4bb7c14":{"type":"File","value":"b77fa0943cfbe26b2a65d5d630644a85c57471647cceb7d085da421bd4bb7c14"},"File:b8b639cc15ff931c0041be21aa9a5ee0303dc94ea0ac156b52adee5984324240":{"type":"File","value":"b8b639cc15ff931c0041be21aa9a5ee0303dc94ea0ac156b52adee5984324240"},"File:bc02393457e2f400ebb91f24b10962bd348dcf0e21eb1fddfd1e22d421bd0bc7":{"type":"File","value":"bc02393457e2f400ebb91f24b10962bd348dcf0e21eb1fddfd1e22d421bd0bc7"},"File:bd22e6fb29e59d5526d047b3792fed26f52fa7d326f5d43f6466686d7b785fa4":{"type":"File","value":"bd22e6fb29e59d5526d047b3792fed26f52fa7d326f5d43f6466686d7b785fa4"},"File:c05cbe844cc697a3da76136fefbcc3fcf8dd2350033f3141590609c906e21bc4":{"type":"File","value":"c05cbe844cc697a3da76136fefbcc3fcf8dd2350033f3141590609c906e21bc4"},"File:c0f4a29db2e04a6f3faeffd103a74603ebcf329036311904b5862ce189d2e232":{"type":"File","value":"c0f4a29db2e04a6f3faeffd103a74603ebcf329036311904b5862ce189d2e232"},"File:c27fa17c7e6cf32925d3ebdf093d2be6087335a524702d2859ee875aaf9b2a44":{"type":"File","value":"c27fa17c7e6cf32925d3ebdf093d2be6087335a524702d2859ee875aaf9b2a44"},"File:c2e004f1293a3ebea8a25b72cd2878ab16d56d2cc3c3350ee50891922ffd7a77":{"type":"File","value":"c2e004f1293a3ebea8a25b72cd2878ab16d56d2cc3c3350ee50891922ffd7a77"},"File:c302914220de078a3e665cbfc585247cff86b2b17d15babc4c5a44f6cf760dde":{"type":"File","value":"c302914220de078a3e665cbfc585247cff86b2b17d15babc4c5a44f6cf760dde"},"File:c307b780d7cdc367c3a59652244946db6d37ba8b99c64a481caa2484e0deac93":{"type":"File","value":"c307b780d7cdc367c3a59652244946db6d37ba8b99c64a481caa2484e0deac93"},"File:c33ac38b8e570244f267bea8962562868a2c864dc329b6a308c5c42d3da5b28b":{"type":"File","value":"c33ac38b8e570244f267bea8962562868a2c864dc329b6a308c5c42d3da5b28b"},"File:c34e0aeb07923f0fe5de01d0871f778b73a7d9a32679447934b977e48cd68df3":{"type":"File","value":"c34e0aeb07923f0fe5de01d0871f778b73a7d9a32679447934b977e48cd68df3"},"File:c381800fae4802185cf6f236768882e154666841cf521e9133e974d16dcbdd88":{"type":"File","value":"c381800fae4802185cf6f236768882e154666841cf521e9133e974d16dcbdd88"},"File:c490572cc990cf84cc88589ff52b74b34ae96e2a29dc9e48586a41e757c105a9":{"type":"File","value":"c490572cc990cf84cc88589ff52b74b34ae96e2a29dc9e48586a41e757c105a9"},"File:c52eb363c9e1fd99b87ea6051908897e480a2ad4c36755c3bce14675fb0ee693":{"type":"File","value":"c52eb363c9e1fd99b87ea6051908897e480a2ad4c36755c3bce14675fb0ee693"},"File:c6d7cac93ea33dcaf59a83fd3e0e935d1c6dea7e063dfbbcbec1cf4fb008ab1c":{"type":"File","value":"c6d7cac93ea33dcaf59a83fd3e0e935d1c6dea7e063dfbbcbec1cf4fb008ab1c"},"File:c7c37f424cfe68a5dcb20fb8091a4b1061bb782e593f0e8f1bc691f70cfb9228":{"type":"File","value":"c7c37f424cfe68a5dcb20fb8091a4b1061bb782e593f0e8f1bc691f70cfb9228"},"File:c9635c9daf88db661376d3a9cc9778b35bbb120eea1444da946eb7608bf9913b":{"type":"File","value":"c9635c9daf88db661376d3a9cc9778b35bbb120eea1444da946eb7608bf9913b"},"File:cd1ca539533c9c92a9687c0257680405f6f1d46e4fd3fc2cb5ffa8d704df724a":{"type":"File","value":"cd1ca539533c9c92a9687c0257680405f6f1d46e4fd3fc2cb5ffa8d704df724a"},"File:cdae4390f05b22cee9f228e120abbc795d404240e4dd01c638a875032817d934":{"type":"File","value":"cdae4390f05b22cee9f228e120abbc795d404240e4dd01c638a875032817d934"},"File:cdcfbae26209a4e56402d6f711909dfc3aa957da808cde1be7cd1024633b1c33":{"type":"File","value":"cdcfbae26209a4e56402d6f711909dfc3aa957da808cde1be7cd1024633b1c33"},"File:ce257024344690cf3da066d14d2eeaa15b3ecb2252fa7f7d1e0536492d7c91d3":{"type":"File","value":"ce257024344690cf3da066d14d2eeaa15b3ecb2252fa7f7d1e0536492d7c91d3"},"File:ce9a65f215460279b5fddb9736101bcd9575da06342dfa179745e541933fc8ee":{"type":"File","value":"ce9a65f215460279b5fddb9736101bcd9575da06342dfa179745e541933fc8ee"},"File:cecc0c8d1f94eb6e91d08d8d3f148e457566cd9f50cacdce683e67e21a2326ec":{"type":"File","value":"cecc0c8d1f94eb6e91d08d8d3f148e457566cd9f50cacdce683e67e21a2326ec"},"File:d02e0f9f76e58479a5cbc3d0930fac4073c51e9bb53974834df6b85c9e183e63":{"type":"File","value":"d02e0f9f76e58479a5cbc3d0930fac4073c51e9bb53974834df6b85c9e183e63"},"File:d405be427c4e70ece1295418a485d0fb0b01522b199319f4d7dc4e04c8ebce5a":{"type":"File","value":"d405be427c4e70ece1295418a485d0fb0b01522b199319f4d7dc4e04c8ebce5a"},"File:d515ff2b7870e90da49f5d4d15248fefd4b0d4ebe5c7d4a2c89182fb18486d54":{"type":"File","value":"d515ff2b7870e90da49f5d4d15248fefd4b0d4ebe5c7d4a2c89182fb18486d54"},"File:d61e5e047bb138b4b672c880ce518abcb034f36a02f94a8425121d723063e1d7":{"type":"File","value":"d61e5e047bb138b4b672c880ce518abcb034f36a02f94a8425121d723063e1d7"},"File:d73e6b85d10b8b60d47aee7d419fa465889552e8568177ec58871d8b695ea23c":{"type":"File","value":"d73e6b85d10b8b60d47aee7d419fa465889552e8568177ec58871d8b695ea23c"},"File:d7ed9a50fb68cd4b88cde627cfc976b06436f369258892d826c7ec2eb78e4448":{"type":"File","value":"d7ed9a50fb68cd4b88cde627cfc976b06436f369258892d826c7ec2eb78e4448"},"File:d9757072f0b490b411906c115006732bd0a95df47b14794a520ba30433b9f153":{"type":"File","value":"d9757072f0b490b411906c115006732bd0a95df47b14794a520ba30433b9f153"},"File:d98d277d7d80a79b6afcc24e25e861b308dcfc1da582826c79c92153f54ae5eb":{"type":"File","value":"d98d277d7d80a79b6afcc24e25e861b308dcfc1da582826c79c92153f54ae5eb"},"File:da81975be61bde82dd75d0da6f279f68b3af8e39495af49b5b536f3d4bee99c7":{"type":"File","value":"da81975be61bde82dd75d0da6f279f68b3af8e39495af49b5b536f3d4bee99c7"},"File:dc9ac3f6a55f2752e93f7ea586c70aa4c606e9bcf81e35543f183100de528100":{"type":"File","value":"dc9ac3f6a55f2752e93f7ea586c70aa4c606e9bcf81e35543f183100de528100"},"File:dd8bb58183e82edd4a5683145250018b46cd3754fa49c6365cba2a62e3658156":{"type":"File","value":"dd8bb58183e82edd4a5683145250018b46cd3754fa49c6365cba2a62e3658156"},"File:dde16ec5e084266c987e47d76e119625a61e5c17b8ce85102a7289c563891085":{"type":"File","value":"dde16ec5e084266c987e47d76e119625a61e5c17b8ce85102a7289c563891085"},"File:df4b0e594cfc7f1adbb65690acc37a85b72644fdb2bb8f4cf2491b75ff8bf474":{"type":"File","value":"df4b0e594cfc7f1adbb65690acc37a85b72644fdb2bb8f4cf2491b75ff8bf474"},"File:e092f773ef9a504e427578fbd49f540c76e2095c5208806dd3112ae5c3a4e103":{"type":"File","value":"e092f773ef9a504e427578fbd49f540c76e2095c5208806dd3112ae5c3a4e103"},"File:e16021c07d09ec1faba9196323bfef861e808f49cb960837f7951cede7725d57":{"type":"File","value":"e16021c07d09ec1faba9196323bfef861e808f49cb960837f7951cede7725d57"},"File:e1bc41345c616ea4561ba14c540517eb33e612b9c766948e17745591f9a2fe37":{"type":"File","value":"e1bc41345c616ea4561ba14c540517eb33e612b9c766948e17745591f9a2fe37"},"File:e24a9b8c5b5ec55153a7c051856bc12647794136107c596f1acbbf9660d28332":{"type":"File","value":"e24a9b8c5b5ec55153a7c051856bc12647794136107c596f1acbbf9660d28332"},"File:e2ce0dd47a6f5286e5646581ca0a6ab0a631af36cc5fcd9088865cdd6ede97e0":{"type":"File","value":"e2ce0dd47a6f5286e5646581ca0a6ab0a631af36cc5fcd9088865cdd6ede97e0"},"File:e3158b990f176e65d81f3df6c43c3c256eafffa6531f819d9191ed972f8e0349":{"type":"File","value":"e3158b990f176e65d81f3df6c43c3c256eafffa6531f819d9191ed972f8e0349"},"File:e52adee3bcf99fb6ddd090b561ccbca4573331c04f9454adcf9f13c1239d4a22":{"type":"File","value":"e52adee3bcf99fb6ddd090b561ccbca4573331c04f9454adcf9f13c1239d4a22"},"File:e6a344dca69b374eb7450c0d96070c3e746f2aeb9ab979490ceb23198a817050":{"type":"File","value":"e6a344dca69b374eb7450c0d96070c3e746f2aeb9ab979490ceb23198a817050"},"File:e6fbb6052b293b14e42aaf5eb468e475661bbb043a5677960c6289ae2baad082":{"type":"File","value":"e6fbb6052b293b14e42aaf5eb468e475661bbb043a5677960c6289ae2baad082"},"File:e9e1f0ea6f0f500498d53e779ada49d27806b028e7262e5f8a2d6d561cc18e76":{"type":"File","value":"e9e1f0ea6f0f500498d53e779ada49d27806b028e7262e5f8a2d6d561cc18e76"},"File:ea9483afb27e5693c129a2e75f60d10d086491c81d66cd0d88d6d33590823521":{"type":"File","value":"ea9483afb27e5693c129a2e75f60d10d086491c81d66cd0d88d6d33590823521"},"File:eadd1bb950ee9dfcb124553a292cc461aa4f53ced1e34d2c0f5ad59a318f1248":{"type":"File","value":"eadd1bb950ee9dfcb124553a292cc461aa4f53ced1e34d2c0f5ad59a318f1248"},"File:f1eff5c6da7ae5934152c778f272b35c5f584a8ac88e0f902a6fdd5ee3683e96":{"type":"File","value":"f1eff5c6da7ae5934152c778f272b35c5f584a8ac88e0f902a6fdd5ee3683e96"},"File:f20f3256747389465d6b8e619073e5eb100f7a751a023321c7acf1cf1fdb2ab5":{"type":"File","value":"f20f3256747389465d6b8e619073e5eb100f7a751a023321c7acf1cf1fdb2ab5"},"File:f48101be671f8733a7221e74f3af8880fe7c6db5f6436f0dab05f4201c685f67":{"type":"File","value":"f48101be671f8733a7221e74f3af8880fe7c6db5f6436f0dab05f4201c685f67"},"File:f62a486d54f2fc1cb9e4b58898c7325180a40c1ffdd035b53205fa03ce9844b0":{"type":"File","value":"f62a486d54f2fc1cb9e4b58898c7325180a40c1ffdd035b53205fa03ce9844b0"},"File:f6f96e89680e7495c93059d2a8f6f337c624795d7238963bc32b76b09dbe6d52":{"type":"File","value":"f6f96e89680e7495c93059d2a8f6f337c624795d7238963bc32b76b09dbe6d52"},"File:f9c4e7eb90676a60539d924675864a5578cc399e7a5d4d9178f87c0c4d14a36a":{"type":"File","value":"f9c4e7eb90676a60539d924675864a5578cc399e7a5d4d9178f87c0c4d14a36a"},"File:fab43c8b1d20a5e622d7476be17199b42272a9550722198e555ca69008f03cf9":{"type":"File","value":"fab43c8b1d20a5e622d7476be17199b42272a9550722198e555ca69008f03cf9"},"File:fb53d7032ce277dca50f1e169d7dd60435c16cd0deff9e85102eabe40c41df63":{"type":"File","value":"fb53d7032ce277dca50f1e169d7dd60435c16cd0deff9e85102eabe40c41df63"},"File:fc425c24178ba7a42d48cc1bda457e41ee72dc8d448b4027004da421cd9cf821":{"type":"File","value":"fc425c24178ba7a42d48cc1bda457e41ee72dc8d448b4027004da421cd9cf821"},"File:fefecd5389687c0eecb5a1fc0939206022f7cf9dfe78ff73f1a97c66348e5459":{"type":"File","value":"fefecd5389687c0eecb5a1fc0939206022f7cf9dfe78ff73f1a97c66348e5459"},"Ip:202.61.140.222":{"type":"Ip","value":"202.61.140.222"}},"chains":[{"id":"sandbox_network","root":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","edges":[{"edge_kind":"contacted_ip","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"Ip:202.61.140.222"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","edges":[{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:d405be427c4e70ece1295418a485d0fb0b01522b199319f4d7dc4e04c8ebce5a"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:cdcfbae26209a4e56402d6f711909dfc3aa957da808cde1be7cd1024633b1c33"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:a7fce884389705de40a5fb6883d5b4ef39a961c706d4639c13ebded8b5cf6b72"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:325a08926b965cce6ee134c851b74f4e13c8588a75c662448acdadb1ffce5d18"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:c33ac38b8e570244f267bea8962562868a2c864dc329b6a308c5c42d3da5b28b"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:92c03a27efdeb4b87eab5f60a3b389396fa21e1e14551ef0ecbef4f4ffa124e3"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:b77fa0943cfbe26b2a65d5d630644a85c57471647cceb7d085da421bd4bb7c14"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:4f952fea77b5b7f755271ec1e7250cea8d86670b2ebca16990856dc0c447cd82"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:f20f3256747389465d6b8e619073e5eb100f7a751a023321c7acf1cf1fdb2ab5"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:181193a09a8227a24686bd6a3ae8cfe302e4ec90384802c9fed0ac352c993568"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:8312f13f0eb0cb00984a1e92738afdd5a2fc2f10e891ee3b127c536a9d325dbc"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:b692dce4de10fa19b0967f6a9256502d7a4880c799203750cca6977df43ba9fa"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:d73e6b85d10b8b60d47aee7d419fa465889552e8568177ec58871d8b695ea23c"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:c2e004f1293a3ebea8a25b72cd2878ab16d56d2cc3c3350ee50891922ffd7a77"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:c52eb363c9e1fd99b87ea6051908897e480a2ad4c36755c3bce14675fb0ee693"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:c302914220de078a3e665cbfc585247cff86b2b17d15babc4c5a44f6cf760dde"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:4c575fa901ca678ceb5289fa2f6bdf5ad02d065ad953109f0883ce3d4e670191"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:b479f9bf12df433162f9c82eb62fa8c62f09b4be2cd8657d3a73601fb60b293d"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:3c3046df53d34c97b703c259a1b829ac104bde7d43dbee734ae4acb6f4c10366"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:bc02393457e2f400ebb91f24b10962bd348dcf0e21eb1fddfd1e22d421bd0bc7"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:2bb39e21d803e74302e635f6a521bf887bbd05c214894647ec93cf9d76a3ab25"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:c307b780d7cdc367c3a59652244946db6d37ba8b99c64a481caa2484e0deac93"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:ce9a65f215460279b5fddb9736101bcd9575da06342dfa179745e541933fc8ee"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:d7ed9a50fb68cd4b88cde627cfc976b06436f369258892d826c7ec2eb78e4448"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:06c4d0b63a4f89e1ff744845295bbcc0ef5987b85ba8b9ec66be9e7a39dd3633"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:58ba879097ceb35a24a986ebff18c739849ce1052c31275004d6a5923f0a0f4b"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:4574417c613859da5e1fd74400f7e2ce7f6fccf4a75b93ad59cbdab4c3b2f081"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:16abda71d7ce417b9d33e859d4a76b682b03b29df661553654baa837d1bef63e"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:5bb1cc0ffa340b1a0e524339b0a00b57d7b0893498adadff708a122c8c6c66f8"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:e9e1f0ea6f0f500498d53e779ada49d27806b028e7262e5f8a2d6d561cc18e76"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:00ef46a47ca50a301e1171d4fcb181e9a08ef63be060e745637fdb9ab0d42c54"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:32ec6326f16a05f434030ab7dd5ee26eb2afb4c66446c9cb7a9814df638733ac"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:e3158b990f176e65d81f3df6c43c3c256eafffa6531f819d9191ed972f8e0349"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:da81975be61bde82dd75d0da6f279f68b3af8e39495af49b5b536f3d4bee99c7"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:14821aad4cd1c5a6177003f27237e85eaab52e170a031254d76aee6fbe0cd7b6"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:d9757072f0b490b411906c115006732bd0a95df47b14794a520ba30433b9f153"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:937779884acc39b73c28c2434bf1c7739532096f4c40a3ae7dc2e4662a25fe5f"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:2b1a16dd7c756b04f6fb919d867527ab4b33e3e013bd4ed146b05aaf94390ab6"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:4d0506a2aea1dcf3d3dc11277b785fbf36dee4c27ba96ce60f24c846bf32f09a"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:224415d3654759f84083d0ba7898bc712a56e2eaae4eb55c417ccbdef7b5e16c"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:6ff1f9d5f5d13ef8288c999a7f966a068d5fe5c0b29c9a4476d5c7f53833cf1c"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:191d92c4c10fd37d455dd91221f2f8c732bb17e87857aa49d9e7b7850fc438cd"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:223a9f556d330430ac1c1d9691e14ecc4f3c89fd7ddd608e5e7141fe7fcb075f"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:50c9d68660d54b1b6a01a9113340e43297d4b0835ab466090b4e21edb01cc138"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:1cf327fa3ad93b5d53c9536035f95a41369466f5a769fdad68408f1c9823feb2"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:281ce3cfa9418eb90aa0cf2196ca6ed630ee3635df85246c3da2b5efa0ecf395"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:4b8f8b44d0a4e8c7fcdeae8163140817c2bf2bef2d6b0f3e3d37313874da13e3"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:7b823be337ac66f29fd0ae98f82c4d2f5ceae9be3cbdc1029f57b5476998490c"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:25862d27200b8c2fd40aba3cbbdd29281c3d5f81b77cb24312bc3874e9c4fe6e"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:25b2899000157a07aa90ea02474cbfa11dcb32933ef24f941e2c31afaf1f95cb"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:e6a344dca69b374eb7450c0d96070c3e746f2aeb9ab979490ceb23198a817050"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:38aef924cdd029f262cf67e0fd918f7460b600a2bc88dceec88eee67a92dc713"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:a469d7e592d8729b552d402123ba27fd1b501f3193a91a6ef7f1bf08c08d9bb0"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:2fadffbbf9c249a6ffdcae6e70f23d85f027ef220cf7a0015d8cec1c075790a0"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:086769a44ee43503c4191e83a3a6c7923fce8a27252f979be7b0f8158427b931"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:cdae4390f05b22cee9f228e120abbc795d404240e4dd01c638a875032817d934"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:374f316f063f0f86163ec5206fb195de50c01951126cc90438462d9d1e7262d4"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:28ea8be5aeef3b0835ea94ebf033c0362ce5cbf4b8cdaf45e442c85075753933"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:41c56cf3ae55994d08fc7d6622ead753e59e6b6d90072d6c621aa71c12017616"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:a804331a4ed0ae77eb8959c537f606ff9ebd9d1f5ef1d16c20b286d8b2bd14f8"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:223473401d7c1631f31c002c764ad490bf75fa77f6f2cab20b1583cb33ce1543"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:c9635c9daf88db661376d3a9cc9778b35bbb120eea1444da946eb7608bf9913b"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:61f18aa5ff48b390e47fa42838ee1bf7d8c0f160417c2df65aafb8359363cea1"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:fb53d7032ce277dca50f1e169d7dd60435c16cd0deff9e85102eabe40c41df63"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:74855b1061b567b7bf78d3954436583bbff23b9b5cb0770462606f9f01d0ad16"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:52104c4702442bb63169f669d48f329ff81abb06d469ff822ef405a02ee4e10d"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:d61e5e047bb138b4b672c880ce518abcb034f36a02f94a8425121d723063e1d7"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:5439f31222340cd858c6e55c70fde29e0c0a8f2593d2e8e47b8aa8cdf06e7945"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:dde16ec5e084266c987e47d76e119625a61e5c17b8ce85102a7289c563891085"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:0b729ea4e4b1650371d0279a2c2a9ebbb528c37532443193cf218c85f39c3085"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:cecc0c8d1f94eb6e91d08d8d3f148e457566cd9f50cacdce683e67e21a2326ec"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:43b107c7a882ffdd1ce4422d50d902bdeba8a6db35e18ad0c6515b148b95f20f"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:4e76d807dd41e3c2c9343616159b6a73f3d7d5c0e73e40ea862287d7b27e7d4d"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:c6d7cac93ea33dcaf59a83fd3e0e935d1c6dea7e063dfbbcbec1cf4fb008ab1c"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:bd22e6fb29e59d5526d047b3792fed26f52fa7d326f5d43f6466686d7b785fa4"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:4b840c686636d0250204ec2b960f577f600f63ff772aa484bcf2f6be876deedb"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:f1eff5c6da7ae5934152c778f272b35c5f584a8ac88e0f902a6fdd5ee3683e96"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:87dbd2b9dcea628b5f0ae62d005d4d2c5419773b86f785cc4380e7c254d9a300"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:713c21e79be3b0bbd0e98eddc18ed063282fbbcd0e40330972b55062f1d1aacd"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:207d35b0d247d8ccd2d9c9c5e7a423e1626a6c3cd9c0db99eaba25232808dc73"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:a550de53478bc162001469abbebcb0e9fa2194c24ae7b344f6b6f28147f395d8"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:fc425c24178ba7a42d48cc1bda457e41ee72dc8d448b4027004da421cd9cf821"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:f62a486d54f2fc1cb9e4b58898c7325180a40c1ffdd035b53205fa03ce9844b0"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:273a455af3ad373ab68a7ebc7025454bfd6d048e25eb51015a2aa30883347cec"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:26afc05ecad5732940aaa59b44262b1bf56a67d72cd8f2a29b05bd5e15aa5490"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:9ea5864a82930feed447360c3931dc3c438801481d31f2cb6047a938adbe0292"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:e24a9b8c5b5ec55153a7c051856bc12647794136107c596f1acbbf9660d28332"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:99241b09a2f242761c4142691280a7200a58d70006e413b5c827712bde32975e"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:add1ace36330709c34ed24be8c221e1e8ad5849be0219b5db3c4997db52b0f19"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:59814609eddb844d34b993a2d5501a128d54bdf4138a8848878430500a632b2c"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:869f79d4b8cec1f4fb9941a7cff44e0731c0ce041ec751ad71c6339d30b7cfe5"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:92f29048233840e5eb29f07d56ab2d7420e59b77cb0d1e11519f0b0a0feb5103"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:7673d11a2028d9949b4b70c56457c057e3680e1a61e885b48df243991a21c6ee"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:79ec63e1f7f3a94890a9b4d372483f8ea0d953b3a30c81edf1810e64aef87a90"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:389dfd23e89e62cdb29bdcb6aa282717608cb7cd026762453844123d9ed8fefd"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:35b6b02b8a3b2be5aaed6525b88d4f660e893cba1614132feb88527d541b3af5"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:e52adee3bcf99fb6ddd090b561ccbca4573331c04f9454adcf9f13c1239d4a22"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:6ba7ce4fde8ba3d0c44576e33ac71f27267f0a028abc41aeab17b2994d03b569"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:ea9483afb27e5693c129a2e75f60d10d086491c81d66cd0d88d6d33590823521"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:30edc6840e2dbac4505d29698661ccebf77d435da3e209d26960ae03051ff462"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:1479b1f834ee9205aef5e06a6594d47361cc2fc8074ca6153b1bc7eae514165e"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:c7c37f424cfe68a5dcb20fb8091a4b1061bb782e593f0e8f1bc691f70cfb9228"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:c381800fae4802185cf6f236768882e154666841cf521e9133e974d16dcbdd88"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:495627c7b92e9e0e415a21ac2d0d04ceb3f4d6d55206de8083154c310254aa88"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:ac418e936e7fbba7ef3668a7341ea37123085c44e03db1731f5f90b1d73bac97"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:fefecd5389687c0eecb5a1fc0939206022f7cf9dfe78ff73f1a97c66348e5459"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:5c1d778ed829803eaa99ea19ef2828e00fa7e6ea89a66deea708400aba70998b"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:1ad6abbeacaa0fff14631094cdef96fc98e9cd6703abf1e846a2514c1485fb22"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:8a6c615c9a72b3ed18b528b8f82afbadf4f916e701c15534935a1cf84899d0f3"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:4e084ca2caeeadd684bf52ab72244c879eb3f634af5f4fccf11e91439baf79cd"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:a53eddd431c0a0164603f852e6e96bb8bef0deab2afa89a6a231e72501aa7dd9"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:2529f9823517f572f5f6574d6910278fcc0c0ef0f01f392c05c96f3c10225f9a"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:5e59c4875fc7af94aa9a873acdd93d8da797ae2dc58e6b3ced8701eda610478d"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:c34e0aeb07923f0fe5de01d0871f778b73a7d9a32679447934b977e48cd68df3"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:a2e3b7b7b3657a2d4344d6c40df795866225b024d0c853a48bc6b6740dc9700c"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:afff8491cceaf206852e72983167f65ea740dd92b4b1bbfccd59a70470968a16"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:d98d277d7d80a79b6afcc24e25e861b308dcfc1da582826c79c92153f54ae5eb"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:dd8bb58183e82edd4a5683145250018b46cd3754fa49c6365cba2a62e3658156"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:56853a5ee8d88a5aed4321b8e7f9ffee509651d86a3fee956b9a73ff924bb8b4"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:b2e2277c887443d7d24b115672d491abf62339f136eb985e3263cfd9ae43b38d"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:c490572cc990cf84cc88589ff52b74b34ae96e2a29dc9e48586a41e757c105a9"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:574498d1c77f4c2dde536838e6b47bc2e3d9f647922e84e6bef45a33b2fb90e2"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:7c2e2d1b55a3cc2bd65c786f5c7b28ab2e513ea9da6be010b903437e414a6275"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:e1bc41345c616ea4561ba14c540517eb33e612b9c766948e17745591f9a2fe37"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:422972ad755db8f1152ab9d250d931cce0e3d527be47dc8e24c436c32bbdeaa7"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:293064849f4667a027a8b2f686030d5ffd4701434d9b1dbb6e40ac66f32a5ce6"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:f6f96e89680e7495c93059d2a8f6f337c624795d7238963bc32b76b09dbe6d52"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:c05cbe844cc697a3da76136fefbcc3fcf8dd2350033f3141590609c906e21bc4"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:ce257024344690cf3da066d14d2eeaa15b3ecb2252fa7f7d1e0536492d7c91d3"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:5d2d07446fd83be975a14e620226aad777c6242d3765ec3f1ef4677f615aac0d"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:8b4aeb7b7058dcd976b727b24836c0e6329f33dc80b66846bf659cd3f0aecb33"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:dc9ac3f6a55f2752e93f7ea586c70aa4c606e9bcf81e35543f183100de528100"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:c0f4a29db2e04a6f3faeffd103a74603ebcf329036311904b5862ce189d2e232"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:3761f394e9c5eb155a6520e19c981efd1a4df06b19a39c4be5056ed79e015dbc"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:fab43c8b1d20a5e622d7476be17199b42272a9550722198e555ca69008f03cf9"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:528367d7eb367a52d1d4c9e20e97088e4f7c7391c675d109be903c4a97038f98"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:3472172b9d534c07c05414ed9081712b4b7ec85df7a4d20c20a465c173ba3be9"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:77562d442b83f1fab89f446a4524261d16a9761d2616a7e3a6d0d8b0da86f8cf"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:71f3b92fdfea156f38ffda7e6bf36a004483598df77cc04c620758355a656a71"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:7e38c120f3a93d385c0ab0b0592ff616aefd4899a5138f39e60d853bfa20b747"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:513e6aede759a66603b4aa0576ece14c7d6076aea8c399708ac5aa949523d92d"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:02743fa56963717e2c996dc014fa9d9f36efb84ddb78b24a05688c3f9b3251e8"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:84a6118575553c8723deb73056a45e6363100954986c538ff61176b44ca2e4db"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:9ae80642a7e931105462ab73e2eaad7e0fc54a9cab9c00630ba010c780febe25"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:1d51be86ebd68016d3e0744c1fa9cc8e6be9ab3b14da98e12a4fa5e30ef23d4a"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:9256b0033e037d491f57b31685eb606620c2622bd200f47243c10a0e1a7dbc0d"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:714507650c0a0a217c4d00172e285472e991682e56b921e9294a36478dba91a8"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:cd1ca539533c9c92a9687c0257680405f6f1d46e4fd3fc2cb5ffa8d704df724a"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:d02e0f9f76e58479a5cbc3d0930fac4073c51e9bb53974834df6b85c9e183e63"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:eadd1bb950ee9dfcb124553a292cc461aa4f53ced1e34d2c0f5ad59a318f1248"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:2457bbfc5bfee27705fbad896ee28327ffbad20d56bf333f837711e0cfa20180"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:035fcc03fcf79de11c086c70a0000d6833940ce329eb0fe408ffbd2126f7309f"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:68f7aa0cfed36a385bb3eaac4502f221c88b92b85c421f34c82ee874991b415b"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:17bfd7de3b9913c6f98cf12ef525664039ce83c5ea3cc471fb19ca60e8841454"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:f48101be671f8733a7221e74f3af8880fe7c6db5f6436f0dab05f4201c685f67"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:7b7caf6f157f9157d0fa6fbdf5ed2eef0250b10ecd6187bcb8463d5ff7adf6e6"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:255470331f63a0106cdeaed430131efa33679f110a20383916f586006a679498"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:7a8bf6bdabed856713c7c9f6eabc26e0b0d39fa5cd9fce9c3f95e3e7f23981a4"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:9f2bcff23a8591c310bf298576ef28d20ffde451c0de3e1136b8ff1c1f1c4d1c"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:67b0620f971072ba2b9e46465897afb74d92a503364571fc2249f7bdf148208a"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:e6fbb6052b293b14e42aaf5eb468e475661bbb043a5677960c6289ae2baad082"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:8c08beedc424247e4ca462220c70f74432f925fdaaff5626093b3c5aa65482d2"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:e16021c07d09ec1faba9196323bfef861e808f49cb960837f7951cede7725d57"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:5b3ed0fef08bb59f8da9edd75b9abbc4715c88476ecf3c054572a43871785637"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:c27fa17c7e6cf32925d3ebdf093d2be6087335a524702d2859ee875aaf9b2a44"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:79fc01ce5f7141a9e305a31197f3274feb7885f70ef5b216edfc9217f5b59b44"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:e092f773ef9a504e427578fbd49f540c76e2095c5208806dd3112ae5c3a4e103"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:61d95b5ce7489c99f5950b16237861211966c93b558007d00d2fac5f60e50650"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:f9c4e7eb90676a60539d924675864a5578cc399e7a5d4d9178f87c0c4d14a36a"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:a80f433d31310fa9f7f0bb07c1c9155f31ebfab3ae0d87a026385df9c9e9a317"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:64a0fb50f1c7c1f5b02717c155ae5f6b0cbf3318c68e891a1245c90e6d8ab71d"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:a65dffcc557f0a53ee2e5aa0cdd4ba7bb2c8834364c93972447f3eb90c3cd575"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:df4b0e594cfc7f1adbb65690acc37a85b72644fdb2bb8f4cf2491b75ff8bf474"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:b8b639cc15ff931c0041be21aa9a5ee0303dc94ea0ac156b52adee5984324240"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:d515ff2b7870e90da49f5d4d15248fefd4b0d4ebe5c7d4a2c89182fb18486d54"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:844f1d05053b3009d0ec0993cc7a687d2b905f9322d6662906d54fcf8e245a9b"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:e2ce0dd47a6f5286e5646581ca0a6ab0a631af36cc5fcd9088865cdd6ede97e0"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:9aa15b90f5fd74ca10eaad215acab4871e38fe1a0f831f0cf4d861b4ee0fb9d4"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:5b583d6ef5599d05f66d7a82a44e5c8a0d6cd9911b511389c6b1de9705a92eca"},{"edge_kind":"extracted","from_key":"File:ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab","to_key":"File:700a0ca0ba2efedda6536ddf7905e658890e76b327942a4d8a6afa31a23450b2"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":37,"imported_dlls_count":76,"dropped_files_count":0,"extracted_files_count":181,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["windows-server-utility","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a8b8e1f0c85c707ca0c1938","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Section_entropy_high","contacted_countries":["SGP"],"submit_name":"MSOCF.dll","analysis_start_time":"2026-08-24T00:19:44+00:00","indicators_count":{"informative":282,"suspicious":59,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"202.61.140.222","port":448,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}],"processes":[{"pid":6736,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00006736"},{"pid":7008,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#2","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00007008","icon":"$99"},{"pid":4044,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#1","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004044","icon":"$9a"},{"pid":400,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#3","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00000400","icon":"$9b"},{"pid":1312,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#4","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00001312","icon":"$9c"},{"pid":4656,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#5","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00004656","icon":"$9d"},{"pid":5276,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#6","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00005276","icon":"$9e"},{"pid":3928,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#7","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00003928","icon":"$9f"},{"pid":8,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\MSOCF.dll\",#8","sha256":"de51bae08fd7318c988ef54511b5c08d8c3d9bbb2fc03d76d97116a79afb9e81","normalized_path":"%WINDIR%\\SysWOW64\\rundll32.exe","uid":"00000000-00000008","icon":"$a0"}],"all_imported_dlls":["AcLayers.dll","ucrtbase.dll","cryptsp.dll","winmmbase.dll","pnrpnsp.dll","cfgmgr32.dll","cryptbase.dll","setupapi.dll","imm32.dll","bcryptprimitives.dll","fltLib.dll","dnsapi.dll","user32.dll","msvcp_win.dll","vcruntime140.dll","ole32.dll","wbemcomn.dll","shell32.dll","mpr.dll","sfc_os.dll","nsi.dll","GdiPlus.dll","msasn1.dll","comctl32.dll","SHCore.dll","msvcp140.dll","nlaapi.dll","uxtheme.dll","avicap32.dll","kernel32.dll","combase.dll","advapi32.dll","profapi.dll","MSOCF.dll","FWPUCLNT.DLL","devenum.dll","msdmo.dll","wow64.dll","ws2_32.dll","crypt32.dll","sechost.dll","kernel.appcore.dll","NapiNSP.dll","fastprox.dll","windows.storage.dll","sfc.dll","shlwapi.dll","ntdll.dll","wow64win.dll","gdi32full.dll","sspicli.dll","oleaut32.dll","wbemprox.dll","KernelBase.dll","msvcrt.dll","win32u.dll","gdi32.dll","powrprof.dll","imagehlp.dll","winmm.dll","dxgi.dll","wow64cpu.dll","IPHLPAPI.DLL","msvfw32.dll","rpcrt4.dll","VxSSL32.dll","devobj.dll","wintrust.dll","apphelp.dll","mswsock.dll","rasadhlp.dll","clbcatq.dll","ntmarta.dll","bcrypt.dll","winrnr.dll","wbemsvc.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"BingMaps.dll","sha256":"d405be427c4e70ece1295418a485d0fb0b01522b199319f4d7dc4e04c8ebce5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"aclui.dll","sha256":"cdcfbae26209a4e56402d6f711909dfc3aa957da808cde1be7cd1024633b1c33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AuthFWSnapin.dll","sha256":"a7fce884389705de40a5fb6883d5b4ef39a961c706d4639c13ebded8b5cf6b72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"accessibilitycpl.dll","sha256":"325a08926b965cce6ee134c851b74f4e13c8588a75c662448acdadb1ffce5d18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"cdp.dll","sha256":"c33ac38b8e570244f267bea8962562868a2c864dc329b6a308c5c42d3da5b28b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AcGenral.dll","sha256":"92c03a27efdeb4b87eab5f60a3b389396fa21e1e14551ef0ecbef4f4ffa124e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"cmiv2.dll","sha256":"b77fa0943cfbe26b2a65d5d630644a85c57471647cceb7d085da421bd4bb7c14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"batmeter.dll","sha256":"4f952fea77b5b7f755271ec1e7250cea8d86670b2ebca16990856dc0c447cd82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"ActiveSyncProvider.dll","sha256":"f20f3256747389465d6b8e619073e5eb100f7a751a023321c7acf1cf1fdb2ab5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppVEntSubsystems32.dll","sha256":"181193a09a8227a24686bd6a3ae8cfe302e4ec90384802c9fed0ac352c993568","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppxPackaging.dll","sha256":"8312f13f0eb0cb00984a1e92738afdd5a2fc2f10e891ee3b127c536a9d325dbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AzureSettingSyncProvider.dll","sha256":"b692dce4de10fa19b0967f6a9256502d7a4880c799203750cca6977df43ba9fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AudioEng.dll","sha256":"d73e6b85d10b8b60d47aee7d419fa465889552e8568177ec58871d8b695ea23c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AudioSes.dll","sha256":"c2e004f1293a3ebea8a25b72cd2878ab16d56d2cc3c3350ee50891922ffd7a77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"aadtb.dll","sha256":"c52eb363c9e1fd99b87ea6051908897e480a2ad4c36755c3bce14675fb0ee693","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"cdprt.dll","sha256":"c302914220de078a3e665cbfc585247cff86b2b17d15babc4c5a44f6cf760dde","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"bcastdvr.exe","sha256":"4c575fa901ca678ceb5289fa2f6bdf5ad02d065ad953109f0883ce3d4e670191","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"autochk.exe","sha256":"b479f9bf12df433162f9c82eb62fa8c62f09b4be2cd8657d3a73601fb60b293d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"autoconv.exe","sha256":"3c3046df53d34c97b703c259a1b829ac104bde7d43dbee734ae4acb6f4c10366","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"cdosys.dll","sha256":"bc02393457e2f400ebb91f24b10962bd348dcf0e21eb1fddfd1e22d421bd0bc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"EmbeddedDriverService.sys","sha256":"70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"adtschema.dll","sha256":"2bb39e21d803e74302e635f6a521bf887bbd05c214894647ec93cf9d76a3ab25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"apphelp.dll","sha256":"c307b780d7cdc367c3a59652244946db6d37ba8b99c64a481caa2484e0deac93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppxApplicabilityEngine.dll","sha256":"ce9a65f215460279b5fddb9736101bcd9575da06342dfa179745e541933fc8ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppXDeploymentClient.dll","sha256":"d7ed9a50fb68cd4b88cde627cfc976b06436f369258892d826c7ec2eb78e4448","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"advapi32.dll","sha256":"06c4d0b63a4f89e1ff744845295bbcc0ef5987b85ba8b9ec66be9e7a39dd3633","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppResolver.dll","sha256":"58ba879097ceb35a24a986ebff18c739849ce1052c31275004d6a5923f0a0f4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AUDIOKSE.dll","sha256":"4574417c613859da5e1fd74400f7e2ce7f6fccf4a75b93ad59cbdab4c3b2f081","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AcLayers.dll","sha256":"16abda71d7ce417b9d33e859d4a76b682b03b29df661553654baa837d1bef63e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"bcryptprimitives.dll","sha256":"5bb1cc0ffa340b1a0e524339b0a00b57d7b0893498adadff708a122c8c6c66f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"certcli.dll","sha256":"e9e1f0ea6f0f500498d53e779ada49d27806b028e7262e5f8a2d6d561cc18e76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BCP47Langs.dll","sha256":"00ef46a47ca50a301e1171d4fcb181e9a08ef63be060e745637fdb9ab0d42c54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"atmfd.dll","sha256":"32ec6326f16a05f434030ab7dd5ee26eb2afb4c66446c9cb7a9814df638733ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"biwinrt.dll","sha256":"e3158b990f176e65d81f3df6c43c3c256eafffa6531f819d9191ed972f8e0349","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"capauthz.dll","sha256":"da81975be61bde82dd75d0da6f279f68b3af8e39495af49b5b536f3d4bee99c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"aepic.dll","sha256":"14821aad4cd1c5a6177003f27237e85eaab52e170a031254d76aee6fbe0cd7b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppxAllUserStore.dll","sha256":"d9757072f0b490b411906c115006732bd0a95df47b14794a520ba30433b9f153","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"basecsp.dll","sha256":"937779884acc39b73c28c2434bf1c7739532096f4c40a3ae7dc2e4662a25fe5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"altspace.dll","sha256":"2b1a16dd7c756b04f6fb919d867527ab4b33e3e013bd4ed146b05aaf94390ab6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppxSip.dll","sha256":"4d0506a2aea1dcf3d3dc11277b785fbf36dee4c27ba96ce60f24c846bf32f09a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"advpack.dll","sha256":"224415d3654759f84083d0ba7898bc712a56e2eaae4eb55c417ccbdef7b5e16c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"cabinet.dll","sha256":"6ff1f9d5f5d13ef8288c999a7f966a068d5fe5c0b29c9a4476d5c7f53833cf1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AuthFWWizFwk.dll","sha256":"191d92c4c10fd37d455dd91221f2f8c732bb17e87857aa49d9e7b7850fc438cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"bcd.dll","sha256":"223a9f556d330430ac1c1d9691e14ecc4f3c89fd7ddd608e5e7141fe7fcb075f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"bcrypt.dll","sha256":"50c9d68660d54b1b6a01a9113340e43297d4b0835ab466090b4e21edb01cc138","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"auditpolmsg.dll","sha256":"1cf327fa3ad93b5d53c9536035f95a41369466f5a769fdad68408f1c9823feb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AddressParser.dll","sha256":"281ce3cfa9418eb90aa0cf2196ca6ed630ee3635df85246c3da2b5efa0ecf395","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"appidapi.dll","sha256":"4b8f8b44d0a4e8c7fcdeae8163140817c2bf2bef2d6b0f3e3d37313874da13e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"CameraSettingsUIHost.exe","sha256":"7b823be337ac66f29fd0ae98f82c4d2f5ceae9be3cbdc1029f57b5476998490c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"aeevts.dll","sha256":"25862d27200b8c2fd40aba3cbbdd29281c3d5f81b77cb24312bc3874e9c4fe6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"aspnet_counters.dll","sha256":"25b2899000157a07aa90ea02474cbfa11dcb32933ef24f941e2c31afaf1f95cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BthTelemetry.dll","sha256":"e6a344dca69b374eb7450c0d96070c3e746f2aeb9ab979490ceb23198a817050","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"avrt.dll","sha256":"38aef924cdd029f262cf67e0fd918f7460b600a2bc88dceec88eee67a92dc713","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppVClientPS.dll","sha256":"a469d7e592d8729b552d402123ba27fd1b501f3193a91a6ef7f1bf08c08d9bb0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"backgroundTaskHost.exe","sha256":"2fadffbbf9c249a6ffdcae6e70f23d85f027ef220cf7a0015d8cec1c075790a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppVTerminator.dll","sha256":"086769a44ee43503c4191e83a3a6c7923fce8a27252f979be7b0f8158427b931","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppVSentinel.dll","sha256":"cdae4390f05b22cee9f228e120abbc795d404240e4dd01c638a875032817d934","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"asferror.dll","sha256":"374f316f063f0f86163ec5206fb195de50c01951126cc90438462d9d1e7262d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"advapi32res.dll","sha256":"28ea8be5aeef3b0835ea94ebf033c0362ce5cbf4b8cdaf45e442c85075753933","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BOOTVID.DLL","sha256":"41c56cf3ae55994d08fc7d6622ead753e59e6b6d90072d6c621aa71c12017616","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"sys_cache.dat","sha256":"a804331a4ed0ae77eb8959c537f606ff9ebd9d1f5ef1d16c20b286d8b2bd14f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"autofmt.exe","sha256":"223473401d7c1631f31c002c764ad490bf75fa77f6f2cab20b1583cb33ce1543","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"azroles.dll","sha256":"c9635c9daf88db661376d3a9cc9778b35bbb120eea1444da946eb7608bf9913b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BingOnlineServices.dll","sha256":"61f18aa5ff48b390e47fa42838ee1bf7d8c0f160417c2df65aafb8359363cea1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"appwiz.cpl","sha256":"fb53d7032ce277dca50f1e169d7dd60435c16cd0deff9e85102eabe40c41df63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppointmentApis.dll","sha256":"74855b1061b567b7bf78d3954436583bbff23b9b5cb0770462606f9f01d0ad16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"certca.dll","sha256":"52104c4702442bb63169f669d48f329ff81abb06d469ff822ef405a02ee4e10d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppContracts.dll","sha256":"d61e5e047bb138b4b672c880ce518abcb034f36a02f94a8425121d723063e1d7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"ActionCenterCPL.dll","sha256":"5439f31222340cd858c6e55c70fde29e0c0a8f2593d2e8e47b8aa8cdf06e7945","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AcSpecfc.dll","sha256":"dde16ec5e084266c987e47d76e119625a61e5c17b8ce85102a7289c563891085","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"authui.dll","sha256":"0b729ea4e4b1650371d0279a2c2a9ebbb528c37532443193cf218c85f39c3085","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AdmTmpl.dll","sha256":"cecc0c8d1f94eb6e91d08d8d3f148e457566cd9f50cacdce683e67e21a2326ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"ActivationManager.dll","sha256":"43b107c7a882ffdd1ce4422d50d902bdeba8a6db35e18ad0c6515b148b95f20f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"certCredProvider.dll","sha256":"4e76d807dd41e3c2c9343616159b6a73f3d7d5c0e73e40ea862287d7b27e7d4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BcastDVRBroker.dll","sha256":"c6d7cac93ea33dcaf59a83fd3e0e935d1c6dea7e063dfbbcbec1cf4fb008ab1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"catsrvut.dll","sha256":"bd22e6fb29e59d5526d047b3792fed26f52fa7d326f5d43f6466686d7b785fa4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"catsrv.dll","sha256":"4b840c686636d0250204ec2b960f577f600f63ff772aa484bcf2f6be876deedb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"appmgr.dll","sha256":"f1eff5c6da7ae5934152c778f272b35c5f584a8ac88e0f902a6fdd5ee3683e96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AccountsRt.dll","sha256":"87dbd2b9dcea628b5f0ae62d005d4d2c5419773b86f785cc4380e7c254d9a300","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"authfwcfg.dll","sha256":"713c21e79be3b0bbd0e98eddc18ed063282fbbcd0e40330972b55062f1d1aacd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"azroleui.dll","sha256":"207d35b0d247d8ccd2d9c9c5e7a423e1626a6c3cd9c0db99eaba25232808dc73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AuthFWGP.dll","sha256":"a550de53478bc162001469abbebcb0e9fa2194c24ae7b344f6b6f28147f395d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"adsnt.dll","sha256":"fc425c24178ba7a42d48cc1bda457e41ee72dc8d448b4027004da421cd9cf821","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppIdPolicyEngineApi.dll","sha256":"f62a486d54f2fc1cb9e4b58898c7325180a40c1ffdd035b53205fa03ce9844b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"actxprxy.dll","sha256":"273a455af3ad373ab68a7ebc7025454bfd6d048e25eb51015a2aa30883347cec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"ActionCenter.dll","sha256":"26afc05ecad5732940aaa59b44262b1bf56a67d72cd8f2a29b05bd5e15aa5490","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BcastDVRClient.dll","sha256":"9ea5864a82930feed447360c3931dc3c438801481d31f2cb6047a938adbe0292","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AboveLockAppHost.dll","sha256":"e24a9b8c5b5ec55153a7c051856bc12647794136107c596f1acbbf9660d28332","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BioCredProv.dll","sha256":"99241b09a2f242761c4142691280a7200a58d70006e413b5c827712bde32975e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"audiodev.dll","sha256":"add1ace36330709c34ed24be8c221e1e8ad5849be0219b5db3c4997db52b0f19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppLockerCSP.dll","sha256":"59814609eddb844d34b993a2d5501a128d54bdf4138a8848878430500a632b2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"activeds.dll","sha256":"869f79d4b8cec1f4fb9941a7cff44e0731c0ce041ec751ad71c6339d30b7cfe5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"bthprops.cpl","sha256":"92f29048233840e5eb29f07d56ab2d7420e59b77cb0d1e11519f0b0a0feb5103","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AuditNativeSnapIn.dll","sha256":"7673d11a2028d9949b4b70c56457c057e3680e1a61e885b48df243991a21c6ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"accountaccessor.dll","sha256":"79ec63e1f7f3a94890a9b4d372483f8ea0d953b3a30c81edf1810e64aef87a90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"apds.dll","sha256":"389dfd23e89e62cdb29bdcb6aa282717608cb7cd026762453844123d9ed8fefd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"adsldpc.dll","sha256":"35b6b02b8a3b2be5aaed6525b88d4f660e893cba1614132feb88527d541b3af5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"cemapi.dll","sha256":"e52adee3bcf99fb6ddd090b561ccbca4573331c04f9454adcf9f13c1239d4a22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"87JH27UD.dll","sha256":"6ba7ce4fde8ba3d0c44576e33ac71f27267f0a028abc41aeab17b2994d03b569","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"adsldp.dll","sha256":"ea9483afb27e5693c129a2e75f60d10d086491c81d66cd0d88d6d33590823521","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"authz.dll","sha256":"30edc6840e2dbac4505d29698661ccebf77d435da3e209d26960ae03051ff462","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"bitsadmin.exe","sha256":"1479b1f834ee9205aef5e06a6594d47361cc2fc8074ca6153b1bc7eae514165e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AuthBroker.dll","sha256":"c7c37f424cfe68a5dcb20fb8091a4b1061bb782e593f0e8f1bc691f70cfb9228","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BcastDVRCommon.dll","sha256":"c381800fae4802185cf6f236768882e154666841cf521e9133e974d16dcbdd88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"appmgmts.dll","sha256":"495627c7b92e9e0e415a21ac2d0d04ceb3f4d6d55206de8083154c310254aa88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"aadauthhelper.dll","sha256":"ac418e936e7fbba7ef3668a7341ea37123085c44e03db1731f5f90b1d73bac97","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"cabview.dll","sha256":"fefecd5389687c0eecb5a1fc0939206022f7cf9dfe78ff73f1a97c66348e5459","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"autoplay.dll","sha256":"5c1d778ed829803eaa99ea19ef2828e00fa7e6ea89a66deea708400aba70998b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"bcastdvr.proxy.dll","sha256":"1ad6abbeacaa0fff14631094cdef96fc98e9cd6703abf1e846a2514c1485fb22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppExtension.dll","sha256":"8a6c615c9a72b3ed18b528b8f82afbadf4f916e701c15534935a1cf84899d0f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BluetoothApis.dll","sha256":"4e084ca2caeeadd684bf52ab72244c879eb3f634af5f4fccf11e91439baf79cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"CastingShellExt.dll","sha256":"a53eddd431c0a0164603f852e6e96bb8bef0deab2afa89a6a231e72501aa7dd9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppManagementConfiguration.dll","sha256":"2529f9823517f572f5f6574d6910278fcc0c0ef0f01f392c05c96f3c10225f9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"CallHistoryClient.dll","sha256":"5e59c4875fc7af94aa9a873acdd93d8da797ae2dc58e6b3ced8701eda610478d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BrowserSettingSync.dll","sha256":"c34e0aeb07923f0fe5de01d0871f778b73a7d9a32679447934b977e48cd68df3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppointmentActivation.dll","sha256":"a2e3b7b7b3657a2d4344d6c40df795866225b024d0c853a48bc6b6740dc9700c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"btpanui.dll","sha256":"afff8491cceaf206852e72983167f65ea740dd92b4b1bbfccd59a70470968a16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BitLockerCsp.dll","sha256":"d98d277d7d80a79b6afcc24e25e861b308dcfc1da582826c79c92153f54ae5eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"avifil32.dll","sha256":"dd8bb58183e82edd4a5683145250018b46cd3754fa49c6365cba2a62e3658156","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"adrclient.dll","sha256":"56853a5ee8d88a5aed4321b8e7f9ffee509651d86a3fee956b9a73ff924bb8b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AuthBrokerUI.dll","sha256":"b2e2277c887443d7d24b115672d491abf62339f136eb985e3263cfd9ae43b38d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"CameraCaptureUI.dll","sha256":"c490572cc990cf84cc88589ff52b74b34ae96e2a29dc9e48586a41e757c105a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"adsmsext.dll","sha256":"574498d1c77f4c2dde536838e6b47bc2e3d9f647922e84e6bef45a33b2fb90e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AcXtrnal.dll","sha256":"7c2e2d1b55a3cc2bd65c786f5c7b28ab2e513ea9da6be010b903437e414a6275","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AppCapture.dll","sha256":"e1bc41345c616ea4561ba14c540517eb33e612b9c766948e17745591f9a2fe37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"atl.dll","sha256":"422972ad755db8f1152ab9d250d931cce0e3d527be47dc8e24c436c32bbdeaa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"bootcfg.exe","sha256":"293064849f4667a027a8b2f686030d5ffd4701434d9b1dbb6e40ac66f32a5ce6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"amstream.dll","sha256":"f6f96e89680e7495c93059d2a8f6f337c624795d7238963bc32b76b09dbe6d52","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"CallButtons.dll","sha256":"c05cbe844cc697a3da76136fefbcc3fcf8dd2350033f3141590609c906e21bc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"asycfilt.dll","sha256":"ce257024344690cf3da066d14d2eeaa15b3ecb2252fa7f7d1e0536492d7c91d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"cca.dll","sha256":"5d2d07446fd83be975a14e620226aad777c6242d3765ec3f1ef4677f615aac0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"avicap32.dll","sha256":"8b4aeb7b7058dcd976b727b24836c0e6329f33dc80b66846bf659cd3f0aecb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"acppage.dll","sha256":"dc9ac3f6a55f2752e93f7ea586c70aa4c606e9bcf81e35543f183100de528100","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"CapabilityAccessManagerClient.dll","sha256":"c0f4a29db2e04a6f3faeffd103a74603ebcf329036311904b5862ce189d2e232","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"ApiSetHost.AppExecutionAlias.dll","sha256":"3761f394e9c5eb155a6520e19c981efd1a4df06b19a39c4be5056ed79e015dbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BackgroundMediaPolicy.dll","sha256":"fab43c8b1d20a5e622d7476be17199b42272a9550722198e555ca69008f03cf9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AuditPolicyGPInterop.dll","sha256":"528367d7eb367a52d1d4c9e20e97088e4f7c7391c675d109be903c4a97038f98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"cabapi.dll","sha256":"3472172b9d534c07c05414ed9081712b4b7ec85df7a4d20c20a465c173ba3be9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"auditpolcore.dll","sha256":"77562d442b83f1fab89f446a4524261d16a9761d2616a7e3a6d0d8b0da86f8cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AuthExt.dll","sha256":"71f3b92fdfea156f38ffda7e6bf36a004483598df77cc04c620758355a656a71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"capiprovider.dll","sha256":"7e38c120f3a93d385c0ab0b0592ff616aefd4899a5138f39e60d853bfa20b747","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"bidispl.dll","sha256":"513e6aede759a66603b4aa0576ece14c7d6076aea8c399708ac5aa949523d92d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BWContextHandler.dll","sha256":"02743fa56963717e2c996dc014fa9d9f36efb84ddb78b24a05688c3f9b3251e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"amsi.dll","sha256":"84a6118575553c8723deb73056a45e6363100954986c538ff61176b44ca2e4db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"adprovider.dll","sha256":"9ae80642a7e931105462ab73e2eaad7e0fc54a9cab9c00630ba010c780febe25","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AtBroker.exe","sha256":"1d51be86ebd68016d3e0744c1fa9cc8e6be9ab3b14da98e12a4fa5e30ef23d4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"APHostClient.dll","sha256":"9256b0033e037d491f57b31685eb606620c2622bd200f47243c10a0e1a7dbc0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"admwprox.dll","sha256":"714507650c0a0a217c4d00172e285472e991682e56b921e9294a36478dba91a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"ByteCodeGenerator.exe","sha256":"cd1ca539533c9c92a9687c0257680405f6f1d46e4fd3fc2cb5ffa8d704df724a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BitsProxy.dll","sha256":"d02e0f9f76e58479a5cbc3d0930fac4073c51e9bb53974834df6b85c9e183e63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"browcli.dll","sha256":"eadd1bb950ee9dfcb124553a292cc461aa4f53ced1e34d2c0f5ad59a318f1248","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"azman.msc","sha256":"2457bbfc5bfee27705fbad896ee28327ffbad20d56bf333f837711e0cfa20180","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"atmlib.dll","sha256":"035fcc03fcf79de11c086c70a0000d6833940ce329eb0fe408ffbd2126f7309f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"acwow64.dll","sha256":"68f7aa0cfed36a385bb3eaac4502f221c88b92b85c421f34c82ee874991b415b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AdaptiveCards.dll","sha256":"17bfd7de3b9913c6f98cf12ef525664039ce83c5ea3cc471fb19ca60e8841454","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"bthudtask.exe","sha256":"f48101be671f8733a7221e74f3af8880fe7c6db5f6436f0dab05f4201c685f67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"atlthunk.dll","sha256":"7b7caf6f157f9157d0fa6fbdf5ed2eef0250b10ecd6187bcb8463d5ff7adf6e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BackgroundTransferHost.exe","sha256":"255470331f63a0106cdeaed430131efa33679f110a20383916f586006a679498","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AcWinRT.dll","sha256":"7a8bf6bdabed856713c7c9f6eabc26e0b0d39fa5cd9fce9c3f95e3e7f23981a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"Apphlpdm.dll","sha256":"9f2bcff23a8591c310bf298576ef28d20ffde451c0de3e1136b8ff1c1f1c4d1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"ActivationClient.dll","sha256":"67b0620f971072ba2b9e46465897afb74d92a503364571fc2249f7bdf148208a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"auditpol.exe","sha256":"e6fbb6052b293b14e42aaf5eb468e475661bbb043a5677960c6289ae2baad082","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"canonurl.dll","sha256":"8c08beedc424247e4ca462220c70f74432f925fdaaff5626093b3c5aa65482d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"cacls.exe","sha256":"e16021c07d09ec1faba9196323bfef861e808f49cb960837f7951cede7725d57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"ahadmin.dll","sha256":"5b3ed0fef08bb59f8da9edd75b9abbc4715c88476ecf3c054572a43871785637","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"calc.exe","sha256":"c27fa17c7e6cf32925d3ebdf093d2be6087335a524702d2859ee875aaf9b2a44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"aspperf.dll","sha256":"79fc01ce5f7141a9e305a31197f3274feb7885f70ef5b216edfc9217f5b59b44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AzSqlExt.dll","sha256":"e092f773ef9a504e427578fbd49f540c76e2095c5208806dd3112ae5c3a4e103","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"at.exe","sha256":"61d95b5ce7489c99f5950b16237861211966c93b558007d00d2fac5f60e50650","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"catsrvps.dll","sha256":"f9c4e7eb90676a60539d924675864a5578cc399e7a5d4d9178f87c0c4d14a36a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"bitsperf.dll","sha256":"a80f433d31310fa9f7f0bb07c1c9155f31ebfab3ae0d87a026385df9c9e9a317","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"appidtel.exe","sha256":"64a0fb50f1c7c1f5b02717c155ae5f6b0cbf3318c68e891a1245c90e6d8ab71d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"capisp.dll","sha256":"a65dffcc557f0a53ee2e5aa0cdd4ba7bb2c8834364c93972447f3eb90c3cd575","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"AnalogCommonProxyStub.dll","sha256":"df4b0e594cfc7f1adbb65690acc37a85b72644fdb2bb8f4cf2491b75ff8bf474","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"attrib.exe","sha256":"b8b639cc15ff931c0041be21aa9a5ee0303dc94ea0ac156b52adee5984324240","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"CallButtons.ProxyStub.dll","sha256":"d515ff2b7870e90da49f5d4d15248fefd4b0d4ebe5c7d4a2c89182fb18486d54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"BamSettingsClient.dll","sha256":"844f1d05053b3009d0ec0993cc7a687d2b905f9322d6662906d54fcf8e245a9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"browseui.dll","sha256":"e2ce0dd47a6f5286e5646581ca0a6ab0a631af36cc5fcd9088865cdd6ede97e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"apprepapi.dll","sha256":"9aa15b90f5fd74ca10eaad215acab4871e38fe1a0f831f0cf4d861b4ee0fb9d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"acledit.dll","sha256":"5b583d6ef5599d05f66d7a82a44e5c8a0d6cd9911b511389c6b1de9705a92eca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"ARP.EXE","sha256":"700a0ca0ba2efedda6536ddf7905e658890e76b327942a4d8a6afa31a23450b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"path":"%TEMP%\\sys_cache.dat","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"path":"%TEMP%\\EmbeddedDriverService.sys","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"key":"HKCUHKCU\\CC\\0\\","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\\","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"key":"HKCUHKCU\\CONSOLE\\0\\","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\CC\\0\\R32F351A4AEEA5E608853D1A56661059\\R32F351A4AEEA5E608853D1A56661059","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EMBEDDEDDRIVERSERVICE\\","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"key":"HKCUHKCU\\CONSOLE\\0\\3C55EC603B6008FE03B40915B595078E\\3C55EC603B6008FE03B40915B595078E","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MyUniqueApp_SingleInstance","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"SM0:7008:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"Local\\SM0:7008:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"Global\\MyUniqueApp_SingleInstance","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7008:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7008:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"Local\\SM0:4044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"SM0:4044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\BaseNamedObjects\\MyUniqueApp_SingleInstance","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:400:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:400:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"SM0:400:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"Local\\SM0:400:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1312:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1312:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"SM0:1312:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"Local\\SM0:1312:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"SM0:4656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"Local\\SM0:4656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"SM0:5276:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"Local\\SM0:5276:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5276:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5276:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3928:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"Local\\SM0:3928:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"SM0:3928:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3928:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"Local\\SM0:8:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]},{"name":"SM0:8:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a8b8e1f0c85c707ca0c1938"}]}]}},"report_ids":{"sandbox_job_ids":["6a8b8e1f0c85c707ca0c1938"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Yogi.Generic Sample ad755d2dfeaa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ad755d2dfeaa…. Malware family: Yogi.Generic. Threat score 100/100. 11/27 AV engines flagged this file. 9 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab"}],["$","meta","4",{"property":"og:title","content":"Malicious Yogi.Generic Sample ad755d2dfeaa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ad755d2dfeaa…. Malware family: Yogi.Generic. Threat score 100/100. 11/27 AV engines flagged this file. 9 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ad755d2dfeaa23b80d561656848d12d8e66edd99b1169d63a936fe7b01da57ab"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Yogi.Generic Sample ad755d2dfeaa… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ad755d2dfeaa…. Malware family: Yogi.Generic. Threat score 100/100. 11/27 AV engines flagged this file. 9 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$La1","11",{}]]